Data exchange system and method and electronic equipment

Abstract

The invention discloses a data exchange system and method and electronic equipment. The system comprises a safety management center, a data ferry unit, a first database, a first host, a second host and a second database, and the data ferry unit comprises a plurality of ferry machines; the security management center is used for performing identity authentication on the first database; and the data ferry unit is used for transmitting the target data packet from the first host to the second host through the ferry machine after the security management center determines that the identity authentication of the first database is successful, so that the second host transmits the target data packet to the second database. According to the technical scheme provided by the embodiment of the invention, the security of the data exchange process is ensured, and the single-point fault problem of the traditional gatekeeper is solved.

Description

Technical Field

[0001] The present application relates to the field of network and security technology, and in particular to a data exchange system, method and electronic device. Background Art

[0002] At present, it has become a common technical means to prevent attacks from untrusted networks through network security isolation devices (such as network gates). For example, installing a network gate between the internal network and the external network to achieve two-way isolation and data exchange between the internal network and the external network can not only resist various attacks based on the Transmission Control Protocol / Internet Protocol (English: Transmission Control Protocol / Internet Protocol, abbreviated as TCP / IP), but also achieve moderate and controllable data exchange between networks with different security levels.

[0003] However, when two-way isolation and data exchange are achieved through a network gate, there is only one network gate. Once a problem occurs in the network gate, the entire system may be paralyzed and unable to work normally. Therefore, the network gate is prone to single point failure problems. In addition, if an attacker understands the working principle of the network gate, he can construct a malicious program to penetrate the network gate in a targeted manner, and then use the network gate to build an attack path, resulting in a low security of the network gate. Summary of the invention

[0004] The present application provides a data exchange system, method and electronic device to solve the problem that traditional network switches are prone to single point failures and have low security. The specific implementation scheme is as follows:

[0005] In a first aspect, the present application provides a data exchange system, the system comprising: a security management center, a data ferry unit, a first database, a first host, a second host, and a second database, the data ferry unit comprising a plurality of ferry machines;

[0006] The security management center is used to perform identity authentication on the first database;

[0007] The data ferry unit is used to transmit the target data packet from the first host to the second host through the ferry machine after the security management center determines that the identity authentication of the first database is successful, so that the second host transmits the target data packet to the second database; wherein the target data packet is the data packet transmitted by the first database to the first host.

[0008] The first database is authenticated by the security management center, and only after the authentication is successful, the target data packet sent by the first database is transmitted from the first host to the second host through the ferry machine in the data ferry unit, which effectively avoids attacks launched by attackers who understand the working principle of the network gate and construct malicious programs to penetrate the network gate, thereby increasing the security of data exchange. In addition, by replacing the traditional network gate with multiple ferry machines in the data ferry unit to achieve secure data exchange, even if a ferry machine has a problem, there are other ferry machines to exchange data, thereby avoiding the single point failure problem of the traditional network gate, thereby ensuring the security of data exchange while avoiding single point failure.

[0009] In a possible implementation, the first database agent Agent in the first database is used to send an identity data packet to the security management center so that the security management center performs identity authentication on the first database based on the identity data packet; wherein the identity data packet includes identity information of the first database.

[0010] By sending an identity data packet representing the identity of the first database to the security management center through the first database Agent in the first database, the security management center can quickly obtain the identity information of the first database based on the identity data packet, thereby quickly and accurately authenticating the first database, thereby ensuring the accuracy of the identity authentication of the first database and improving the efficiency of the identity authentication of the first database, avoiding access by illegal users, and further improving the security of subsequent data exchange processes.

[0011] In a possible implementation manner, the security management center is further configured to send a first notification message instructing to open a first receiving network port to the first host after determining that the first database identity authentication is successful;

[0012] The first host is used to open the first receiving network port according to the first notification information after receiving the first notification information sent by the security management center; and receive the target data packet sent by the first database through the first receiving network port.

[0013] Through the above system, the security management center will issue an instruction to notify the first host to open the first receiving network port only after the first database identity authentication is successful, so that the first host can receive the target data packet sent by the first database through the first receiving network port, thereby avoiding the first host from receiving data packets sent by illegal users, thereby making the data exchange process more secure, and avoiding the first host from being attacked by opening the first receiving network port for a long time, further ensuring the security of the data exchange system.

[0014] In a possible implementation manner, the security management center is further configured to receive second notification information reported by the first host indicating that the first host has received the target data packet, and send third notification information to the first host indicating closing the first receiving network port according to the second notification information;

[0015] The first host is used to close the first receiving network port according to the third notification information after receiving the third notification information sent by the security management center.

[0016] Through the above system, the first host can immediately close the corresponding receiving network port (i.e., the first receiving network port) after receiving the target data packet, thereby preventing attackers from invading the first host through the first receiving network port, thereby further reducing the security risk of the data exchange process and further improving the security of the data exchange system.

[0017] In a possible implementation, the first host is further used to perform integrity and security verification on the target data packet after closing the first receiving network port, and if it is determined that the target data packet has passed the verification, report a fourth notification message indicating that the target data packet has passed the verification to the security management center.

[0018] Through the above system, based on the integrity and security check performed by the first host on the received target data packet, it is ensured that the target data packet is not accessed or modified without authorization during the transmission between the first database and the first host, and the omission of data in the target data packet is avoided, thereby ensuring the integrity and security of the target data packet, further improving the accuracy and security of the data exchange process, and helping to improve the security of the data exchange system.

[0019] In a possible implementation, the security management center is further used to determine a master ferry machine among multiple ferry machines in the data ferry unit after determining that the first database identity authentication is successful, and install a data ferry program into the system kernel of the master ferry machine, so that the data ferry program controls the master ferry machine to transmit the target data packet from the first host to the second host.

[0020] The security management center controls the master and backup identities of each ferry machine in the data ferry unit to ensure the security of each ferry machine in the data ferry unit. In addition, after the master ferry machine is determined, the ferry program is installed into the system kernel of the master ferry machine, thereby preventing attackers from obtaining ferry machine information in advance, further improving the security of the ferry machine, and controlling the master ferry machine to transmit the target data packet from the first host to the second host, thereby realizing data transmission between the first host and the second host.

[0021] In a possible implementation manner, the data ferry program is used to control the master ferry machine to open the second receiving network port, and control the master ferry machine to receive the target data packet sent by the first host through the second receiving network port; after confirming that the master ferry machine has received the target data packet, control the master ferry machine to close the second receiving network port; and

[0022] The target data packet is stripped of the protocol to obtain a new target data packet; and the integrity and security of the new target data packet are checked; if it is determined that the new target data packet has passed the check, the main ferry is controlled to open the sending network port; and the main ferry is controlled to transmit the target data packet to the second host through the sending network port, so that the second host transmits the new target data packet to the second database.

[0023] The data ferry program controls the second receiving network port opened by the main ferry machine to receive the target data packet sent by the first host, and immediately closes the second receiving network port after receiving the target data packet, so that the main ferry machine only opens the second receiving network port during the data packet reception process, thereby avoiding the second interface network port of the main ferry machine from being attacked, which is beneficial to improving the security of the data exchange process.

[0024] At the same time, the data exchange system can promptly discover problems in the data exchange process between the first host and the main ferry machine by performing integrity and security verification on the new target data packet through the data ferry program, thereby ensuring the security of the data exchange process between the first host and the main ferry machine, and ensuring the integrity and security of the new target data packet.

[0025] In addition, the data ferry program controls the main ferry machine to open the sending network port only after verification, so as to control the main ferry machine to transmit the target data packet to the second host through the sending network port, thereby avoiding the transmission of new target data packets that have not passed the verification to the second host, and avoiding attacks caused by opening the sending network port too early, thereby further improving the security of the data exchange system.

[0026] In a possible implementation manner, the data ferry program is further configured to close the sending network port after determining that the primary ferry machine has transmitted the new target data packet to the second host.

[0027] Through the above system, the sending network port of the main ferry can be closed in time to avoid attacks, further improving the security of the data exchange system.

[0028] In a second aspect, the present application further provides a data exchange method, which is applied to a data exchange system, comprising:

[0029] The data exchange system performs identity authentication on the first database through the security management center;

[0030] After the security management center determines that the identity authentication of the first database is successful, the data exchange system transmits the target data packet from the first host to the second host through a ferry machine among multiple ferry machines in the data ferry unit, so that the second host transmits the target data packet to the second database; wherein the target data packet is the data packet transmitted by the first database to the first host.

[0031] In a third aspect, the present application provides an electronic device, including:

[0032] Memory, used to store computer programs;

[0033] The processor is used to implement the above-mentioned data exchange method steps when executing the computer program stored in the memory.

[0034] In a fourth aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the above-mentioned data exchange method steps are implemented.

[0035] For each aspect from the second to the fourth aspect and the technical effects that may be achieved by each aspect, please refer to the above description of the technical effects that can be achieved by the first aspect or various possible schemes in the first aspect, and no further details will be given here. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1a A structural diagram 1 of a data exchange system provided in an embodiment of the present application;

[0037] Figure 1b A schematic diagram of a data exchange system provided in an embodiment of the present application Figure 2 ;

[0038] Figure 2 A schematic diagram of the processing process of the data exchange system provided in an embodiment of the present application;

[0039] Figure 3 A flowchart of a data exchange method provided in an embodiment of the present application;

[0040] Figure 4 A schematic diagram of an electronic device provided for this application. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. The specific operating methods in the method embodiments can also be applied to device embodiments or system embodiments. It should be noted that in the description of the present application, "multiple" is understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. A is connected to B, which can represent: A is directly connected to B and A is connected to B through C. In addition, in the description of the present application, words such as "first" and "second" are only used to distinguish the purpose of description, and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0042] The embodiments of the present application are described in detail below in conjunction with the accompanying drawings.

[0043] Currently, when bidirectional isolation and data exchange are implemented based on a network gate, once an attacker understands the working principle of the network gate, he can construct a malicious program against the network gate to penetrate the network gate, and then use the network gate to build an attack path to affect data exchange. Therefore, when the network gate is used to implement bidirectional isolation and data exchange, there are security issues. In addition, there is only one network gate, and once there is a problem with the network gate, the entire system may be paralyzed and unable to work normally. Therefore, when the network gate is used to implement bidirectional isolation and data exchange, there is also a single failure problem.

[0044] Therefore, the present application proposes a data exchange system, which replaces the original network gate with multiple ferry machines in the data ferry unit, and transmits the target data packet through the ferry machine in the data ferry unit, which can avoid the single point failure problem of the network gate. In addition, after the security management center successfully authenticates the identity of the first database, the target data packet is transmitted through the ferry machine, which can effectively avoid the attack launched by the attacker who specifically constructs malicious programs to penetrate the network gate under the premise of understanding the working principle of the network gate, thereby achieving the safe transmission of the target data packet while avoiding the single point failure problem of the network gate.

[0045] like Figure 1a The data exchange system provided in the embodiment of the present application is shown in FIG.

[0046] The security management center 11 is used to perform identity authentication on the first database 13 .

[0047] The data ferry unit 12 is used to transmit the target data packet from the first host 14 to the second host 15 through the ferry machine after the security management center 11 determines that the identity authentication of the first database 13 is successful, so that the second host 15 transmits the target data packet to the second database 16; wherein the target data packet is the data packet transmitted from the first database 13 to the first host 14.

[0048] In an embodiment of the present application, the security management center 11 establishes connections with the data ferry unit 12, the first database 13, the first host 14, the second host 15, and the second database 16, so that the data ferry unit 12, the first database 13, the first host 14, the second host 15, and the second database 16 can be managed and controlled by the security management center 11.

[0049] Optionally, the first host 14 may be an external host or an internal host. When the first host 14 is an external host, the first database 13 may be an external database, and the second host 15 may be an internal host; when the first host 14 is an internal host, the first database 13 may be an internal database, and the second host 15 may be an external host. Furthermore, the first host 14 and the second host 15 may be invisible by default.

[0050] In addition, in the embodiments of the present application, Figure 1b As shown, a first database agent (Agent) is installed in the first database 13, so that based on the first database Agent (i.e. Figure 1b The Agent in the first database 13 can perform database environment security monitoring and report to the security management center 11, so as to realize information interaction between the first database 13 and the security management center 11, so that the security management center 11 can perform real-time monitoring more conveniently.

[0051] Similarly, the second database Agent (i.e. Figure 1b Agent in the second database 16 in the system), so as to realize information interaction between the second database 16 and the security management center 11 through the second database Agent, so that the security management center 11 can more conveniently monitor in real time.

[0052] Optionally, before the security management center 11 performs identity authentication on the first database 13, when the first database 13 has a data exchange requirement, the first database Agent first sends an identity data packet to the security management center 11. The identity data packet includes the identity information of the first database 13. Thus, the security management center 11 can quickly and efficiently perform identity authentication on the first database 13 according to the identity information carried in the identity data packet, thereby avoiding access by illegal users (such as attackers) and further improving the security of the data interaction process.

[0053] In an embodiment of the present application, the identity data packet sent by the first database Agent may include, in addition to the identity information of the first database 13, the identity information of the first host 14 to which the first database 13 is to be connected and the identity information of the target host (i.e., the second host 15) and the target database (i.e., the second database 16) to which the data packet is to be sent.

[0054] Exemplarily, the security management center is connected to multiple first databases, multiple first hosts, multiple second hosts, and multiple second databases. The multiple first databases are respectively the first database A, the first database B, and the first database C, the multiple first hosts are respectively the first host A, the first host B, and the first host C, the multiple second hosts are respectively the second host A and the second host B, and the multiple second databases are respectively the second database A, the second database B, and the second database C.

[0055] If the first database A has a data exchange requirement, the first database Agent installed in the first database A sends an identity data packet to the security management center. The identity data packet may include the identity information of the first database A, the identity information of the first host to which the first database A is connected (such as indicating that the first host to which the first database A is connected is the first host B), and the identity information of the target host and the target database to which the first database A is to be sent (such as indicating that the target data packet of the first database A needs to be sent to the second host B and the second database C).

[0056] Therefore, after receiving the identity data packet sent by the first database Agent, the security management center 11 can determine the first host 14, the second host 15 and the second database 16 based on the identity data packet, thereby reducing the identity authentication steps of the first host 14, the second host 15 and the second database 16, and further improving the efficiency of the data exchange process.

[0057] In the embodiment of the present application, the security management center 11 authenticates the first database 13 through the identity data packet, and can perform verification based on the security key carried in the identity data packet, but is not limited to this and can be adjusted according to the specific application scenario.

[0058] Further, after determining that the identity authentication of the first database 13 is successful, the security management center 11 sends a first notification message instructing to open a first receiving network port to the first host 14. The first receiving network port is a network port that can receive information sent by the first database 13.

[0059] The first host 14 is used to open the first receiving network port according to the first notification information after receiving the first notification information sent by the security management center 11. Then, the first host 14 receives the target data packet sent by the first database 13 through the first receiving network port.

[0060] Through the above method, the reception of the target data packet sent by the first database 13 by the first host 14 is controlled by the security management center 11, and the security management center 11 issues an instruction to notify the first host 14 to open the first receiving network port only after the identity authentication of the first database 13 is successful, so that the first host 14 receives the target data packet sent by the first database 13 through the first receiving network port, thereby avoiding the first host 14 from receiving the data packet sent by the illegal user, making the exchange process of the target data packet more secure, and avoiding the first host from being attacked by opening the first receiving network port for a long time, thereby further ensuring the security of the data exchange system.

[0061] Next, after determining that the target data packet has been received, the first host 14 reports the second notification information to the security management center 11. The second notification information indicates that the first host 14 has received the target data packet sent by the first database 13. Thus, by reporting the second notification information, the security management center 11 can immediately determine that the first host 14 has received the target data packet sent by the first database 13.

[0062] After receiving the second notification information reported by the first host 14, the security management center 11 determines that the first host 14 has received the target data packet sent by the first database 13 according to the second notification information, and then sends a third notification information to the first host 14 to close the first receiving network port.

[0063] After receiving the third notification information sent by the security management center 11, the first host 14 closes the first receiving network port according to the third notification information.

[0064] Through the interaction process between the above-mentioned security management center 11 and the first host 14, the first host 14 can immediately close the corresponding receiving network port (i.e., the first receiving network port) after receiving the target data packet, thereby preventing attackers from invading the first host 14 through the first receiving network port, thereby further reducing the security risks of the data exchange process and further improving the security of the data exchange system.

[0065] Furthermore, after closing the first receiving network port, the first host 14 performs integrity and security checks on the target data packet to ensure that the target data packet is not accessed or modified without authorization during the transmission between the first database 13 and the first host 14, and avoids omission of data in the target data packet, thereby ensuring the integrity and security of the target data packet and further improving the accuracy and security of the data exchange process.

[0066] In the embodiment of the present application, the integrity and security check performed by the first host 14 on the target data packet can be implemented in the following manner:

[0067] The first database 13 will send an information packet carrying complete information of the target data packet to the first host 14 before sending the target data packet to the first host 14, or after sending the target data packet to the first host 14, or while sending the target data packet to the first host 14. Therefore, the first host 14 can compare the complete information of the target data packet carried in the information packet with the currently received target data packet, so as to determine whether the target data packet has been received, thereby realizing the integrity and security verification of the target data packet, avoiding the omission of data in the target data packet, and further ensuring the accuracy of the data exchange process.

[0068] If it is determined that the target data packet has passed the verification, the first host 14 reports a fourth notification message indicating that the target data packet has passed the verification to the full management center 11 .

[0069] If it is determined that the target data packet fails the verification, the first host 14 does not report information to the security management center 11 and discards the target data packet.

[0070] Further, after receiving the fourth notification information reported by the first host 14, that is, after determining that the first host 14 receives the target data packet correctly, or after determining that the first database 13 is successfully authenticated, the security management center 11 determines the main ferry machine among the multiple ferry machines in the data ferry unit 12, and installs the written data ferry program into the system kernel of the main ferry machine, so that the data ferry program controls the main ferry machine to transmit the target data packet from the first host 14 to the second host 15, which is conducive to further improving the security of the data exchange system. Among them, the data ferry program closes all data network ports by default (such as closing the second receiving network port and the sending network port by default).

[0071] In the embodiment of the present application, the security management center 11 determines the primary ferry machine among the multiple ferry machines in the data ferry unit 12 according to a preset rule.

[0072] The preset rules indicate the primary and backup identities of each ferry machine in the data ferry unit 12, so that the security management center 11 can quickly determine the primary and backup ferry machines in the data ferry unit 12 according to the preset rules. In addition, the preset rules can be adjusted according to specific application scenarios to flexibly respond to various application scenarios.

[0073] Moreover, in the embodiment of the present application, the data exchange system installs an Agent on each ferry in the data ferry unit 12, so that data can be exchanged with the security management center 11 based on the ferry Agent, so that the ferry Agent receives the primary and backup identity information issued by the security management center 11, thereby determining the primary and backup identities of multiple ferry machines.

[0074] Therefore, the data ferry unit 12 may be composed of multiple ferry machines in a master-slave mode. The multiple ferry machines may be clustered in a cluster mode. The ferry machine may be a virtual machine.

[0075] According to preset rules, the main ferry machine receives the data ferry program issued by the security management center and installs it in the system kernel, so that the data ferry program controls the main ferry machine to complete the connectionless secure exchange of data, so as to improve the efficiency of the data exchange process, thereby making the data exchange process more efficient.

[0076] In the embodiment of the present application, the system kernel may be a Kernel. Figure 1b As shown, the above data ferry program can be installed into the Kernel in the main ferry machine A.

[0077] Furthermore, after the data ferry program is successfully installed and run on the main ferry machine, the data ferry program controls the main ferry machine to open the second receiving network port. The second receiving network port is a network port that can receive information sent by the first host 14.

[0078] Then, the data ferry program controls the main ferry machine to receive data through the second receiving network port (such as Figure 1b and after confirming that the master ferry has received the target data packet, controlling the master ferry to close the second receiving network port, so that the master ferry opens the second receiving network port only during the data packet receiving process, thereby preventing the second interface network port of the master ferry from being attacked, thereby facilitating improving the security of the data exchange process.

[0079] Next, the data ferry program strips the protocol of the target data packet to obtain a new target data packet to ensure the security and isolation of data exchange and restore the specific content of the data in the target data packet.

[0080] In the embodiment of the present application, the data ferry program performs protocol stripping on the target data, which can be performed by adopting the protocol stripping method in the prior art, which will not be described in detail here.

[0081] After obtaining the new target data packet, the data ferry program performs integrity and security checks on the new target data packet to determine whether there are any errors in the target data packet transmitted by the first host 14 and whether it is received completely, so as to avoid omission of data in the target data packet, thereby ensuring the security of the data exchange process between the first host 14 and the main ferry machine, and further reducing the security risks of the data exchange process.

[0082] The specific verification method of the data ferrying program for performing integrity and security verification on the new target data packet may be the same as the specific verification method of the first host 14 for performing integrity and security verification on the target data packet, which will not be repeated here.

[0083] If it is determined that the new target data packet has passed the verification, the data ferry program controls the main ferry machine to open the sending network port, so as to control the main ferry machine to transmit the new target data packet to the second host 15 (such as Figure 1b As shown), it avoids transmitting the new target data packet that fails the verification to the second host 15, and avoids opening the sending network port too early to be attacked, further improving the security of the data exchange process.

[0084] The sending network port can be a network port through which the main ferry machine can transmit information to the second host 15 .

[0085] In the embodiment of the present application, the specific process of the data ferry program controlling the main ferry machine to transmit the new target data packet to the second host 15 through the sending network port is as follows:

[0086] The data ferry program first controls the main ferry machine to initiate a non-Transmission Control Protocol (English: Transmission Control Protocol, abbreviated as TCP) connection request to the second host 15, and then controls the main ferry machine to transmit the new target data packet to the second host 15 through the sending network port, so that the second host 15 transmits the new target data packet to the second database 16, thereby completing the transmission of the new target data packet, so that the efficiency of the data exchange process is further improved, thereby making the data exchange process more efficient.

[0087] In the embodiment of the present application, the data ferry program controls the main ferry machine to transmit the new target data packet to the second host 15 through the sending network port, and the new target data packet can be transmitted in the form of a message. That is, the data ferry program controls the main ferry machine to transmit the target message (i.e., the message corresponding to the new target data packet) to the second host 15 through the sending network port, so that the second host 15 transmits the target message to the second database 16.

[0088] Furthermore, after confirming that the new target data packet has been transmitted to the second host 15, the data ferry program controls the main ferry machine to close the sending network port, so that the sending network port of the main ferry machine can be closed in time to avoid attacks, thereby further improving the security of the data exchange system.

[0089] Optionally, after receiving the new target data packet, the second host 15 may also perform integrity and security verification on the new target data packet, and then transmit the new target data packet to the second database 16 after the verification is passed, thereby avoiding the loss of data in the new target data packet and avoiding the new target data packet from being tampered with during transmission, thereby ensuring the security of the new target data packet when it is transmitted between the main ferry and the second host 15, and further improving the security of the data exchange system.

[0090] In the embodiment of the present application, the integrity and security check performed by the second host 15 on the new target data packet may be the same as the specific check method performed by the first host 14 on the target data packet, which will not be repeated here.

[0091] Optionally, after receiving the new target data packet, the security management center 11 controls the second host 15 to open its sending network port for sending data to the second database 16, and the security management center 11 controls the second database 16 to open a third receiving network port for receiving data sent by the second host 15, thereby transmitting the new target data packet from the second host 15 to the second database 16 through the sending network port of the second host 15 and the third receiving network port of the second database 16.

[0092] Moreover, after confirming that the new target data packet has been transmitted from the second host 15 to the second database 16, the security management center 11 also controls the closing of the sending network port of the second host 15 and the third receiving network port of the second database 16, so that the sending network port of the second host 15 and the third receiving network port of the second database 16 can be opened and closed in time to avoid the network port from being attacked, which is conducive to further improving the security of the data exchange system.

[0093] Optionally, after receiving the new target data packet, the second database 16 may also perform security and integrity verification on the new target data packet, thereby avoiding the loss of data in the new target data packet and avoiding the new target data packet from being tampered with during transmission, thereby ensuring the security of the new target data packet when transmitted between the second host 15 and the second database 16, and further improving the security of the data exchange system.

[0094] In the embodiment of the present application, the integrity and security check performed by the second database 16 on the new target data packet may be the same as the specific check method performed by the first host 14 on the target data packet, which will not be repeated here.

[0095] In addition, in the embodiment of the present application, since the data ferry unit 12 in the data exchange system has multiple ferry machines, when the main ferry machine fails, the security management center 11 re-determines the main ferry machine (i.e., the new main ferry machine) from the remaining backup ferry machines according to preset rules, and then realizes data exchange through the new main ferry machine, thereby solving the single point failure problem of traditional network gateways.

[0096] The above process of realizing data exchange through the new main ferry is consistent with the above process of realizing data exchange through the main ferry, and will not be repeated here.

[0097] In summary, the data exchange system proposed in the present application is a system in which an Agent installed on the first database (i.e., the first database Agent) sends an identity data packet representing the identity information of the first database to the security management center, and the first database is authenticated by the security management center. Only after the authentication is successful, the first database is allowed to connect to the first host. Data is then exchanged between the first host and the second host through the ferry machine in the data ferry unit, and the security management center performs real-time management and control, thereby effectively avoiding attacks launched by malicious programs that penetrate the network gate in a targeted manner when the attacker understands the working principle of the network gate, thereby making data exchange more secure.

[0098] In addition, the data ferry unit is composed of several ferry machine clusters in a master-slave mode, and the traditional network gate is replaced by a virtualized ferry machine, thereby ensuring the security of data exchange while solving the problem of single point failure that traditional network gates are prone to.

[0099] In addition, the data ferry unit is also managed by the security management center. It receives the data ferry program issued by the security management center and installs it in the system kernel. The data ferry program controls the connectionless secure exchange of data at the kernel layer, which is more efficient than data exchange at the application layer.

[0100] The technical solution of this application is further explained below in conjunction with a specific application process.

[0101] Take the example of forwarding data from the external network database to the internal network database. Figure 2 As shown, the external network database is the first database 13 , the external network host is the first host 14 , the internal network host is the second host 15 , and the internal network database is the second database 16 .

[0102] Specifically, when the external database has a data exchange demand, the external database Agent installed on the external database sends a data packet (ie, identity data packet) that can represent the identity information of the external database to the security management center.

[0103] The security management center performs identity authentication on the external database according to the identity data packet sent by the external database Agent. When the identity authentication is successful, the security management center returns a token to the external database to indicate that the security management center authentication is successful. At the same time, the security management center determines the external host according to the identity data packet and sends a first notification message to the external host to instruct it to open the receiving network port (i.e., the first receiving network port).

[0104] After receiving the first notification information sent by the security management center, the external network host opens the receiving network port (i.e., the first receiving network port) according to the first notification information, and receives the target data packet sent by the external network database through the receiving network port (i.e., the first receiving network port), and then reports to the security management center the second notification information indicating that the external network host has received the target data packet after confirming that the target data packet has been received.

[0105] The security management center determines, based on the received second notification information, that the external host has received all the target data packets sent by the external database, and then sends a third notification information to the external host to instruct it to close the receiving network port (ie, the first receiving network port).

[0106] After receiving the third notification information sent by the security management center, the first host closes the receiving network port (i.e., the first receiving network port). Then, the external network host performs integrity and security verification on the received target data packet. If it is determined that the target data packet has passed the verification, the external network host reports the fourth notification information indicating that the target data packet has passed the verification to the security management center.

[0107] After receiving the fourth notification information reported by the external network host, the security management center confirms the main ferry machine through preset rules, and installs the compiled data ferry program into the system kernel of the main ferry machine.

[0108] Furthermore, the data ferry program runs in the system kernel of the main ferry machine, controls the main ferry machine to open network port A (i.e., the second receiving network port), and controls the main ferry machine to receive the target data packet sent by the external network host through network port A (i.e., the second receiving network port).

[0109] Then, after confirming that the main ferry machine has finished receiving the target data packet, the data ferry program closes the network port A (ie, the second receiving network port), and then strips the protocol of the target data packet to obtain a new target data packet.

[0110] Next, the data ferry program performs integrity and security verification on the new target data packet. If it is determined that the new target data packet has passed the verification, the data ferry program controls the main ferry machine to open network port B (i.e., the sending network port), and controls the main ferry machine to initiate a non-TCP connection request to the intranet host through network port B (i.e., the sending network port), and then sends the new target data packet to the intranet host through network port B (i.e., the sending network port), so that the intranet host transmits the new target data to the intranet database. Among them, when the data ferry program controls the main ferry machine to send the new target data packet to the intranet host through network port B (i.e., the sending network port), it can control the main ferry machine to send the new target data packet to the intranet host by message forwarding.

[0111] In addition, after confirming that the new target data packet has been sent to the intranet host, the data ferry program closes the network port B (ie, the sending network port).

[0112] Based on the same inventive concept, the present application also provides a data exchange method in an embodiment, which is applied to the data exchange system provided in any of the above embodiments. Figure 3 As shown, the method includes:

[0113] S301, the data exchange system performs identity authentication on the first database through the security management center.

[0114] S302, after the security management center determines that the identity authentication of the first database is successful, the data exchange system transmits the target data packet from the first host to the second host through a ferry machine among multiple ferry machines in the data ferry unit, so that the second host transmits the target data packet to the second database.

[0115] The target data packet is a data packet transmitted from the first database to the first host. The multiple ferry machines in the data ferry unit are composed in a master-slave mode.

[0116] Through the above method, the data exchange system authenticates the first database through the security management center, and only allows the first database to transmit the target data packet to the first host after determining that the first database authentication is successful, and then controls the target data packet to be transmitted from the first host to the second host through the ferry machine among the multiple ferry machines in the data ferry unit, so that the second host can transmit the target data packet to the second database, thereby realizing the safe exchange of the target data packet, effectively avoiding the attack launched by the attacker who understands the working principle of the network gate and constructs malicious programs to penetrate the network gate in a targeted manner, making data exchange more secure, and replacing the traditional network gate with multiple ferry machines in the data ferry unit, effectively solving the problem that the traditional network gate is prone to single point failure.

[0117] Based on the same inventive concept, an electronic device is also provided in the embodiment of the present application. The electronic device can realize the functions of the aforementioned data exchange system. Figure 4 , the electronic equipment includes:

[0118] At least one processor 401, and a memory 402 connected to the at least one processor 401. The specific connection medium between the processor 401 and the memory 402 is not limited in the embodiment of the present application. Figure 4 In the example, the processor 401 and the memory 402 are connected via the bus 400. The bus 400 is Figure 4 The connection between other components is shown by bold lines, and is not intended to be limiting. The bus 400 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 4 Only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. Alternatively, the processor 401 can also be called a controller, and there is no limitation on the name.

[0119] In the embodiment of the present application, the memory 402 stores instructions that can be executed by at least one processor 401. The at least one processor 401 can execute the data exchange method discussed above by executing the instructions stored in the memory 402. The processor 401 can implement Figure 1a-1b The functionality of the system is shown.

[0120] Among them, processor 401 is the control center of the system, and can use various interfaces and lines to connect various parts of the entire control device. By running or executing instructions stored in memory 402 and calling data stored in memory 402, various functions of the system and processing data, the system can be monitored as a whole.

[0121] In one possible design, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, and application programs, and the modem processor mainly processes wireless communications. It is understandable that the modem processor may not be integrated into the processor 401. In some embodiments, the processor 401 and the memory 402 may be implemented on the same chip, and in some embodiments, they may also be implemented separately on separate chips.

[0122] Processor 401 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, and can implement or execute the methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor can be a microprocessor or any conventional processor, etc. The steps of the data exchange method disclosed in the embodiments of the present application can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0123] The memory 402 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. The memory 402 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (English: Random Access Memory, abbreviated as RAM), a static random access memory (English: Static Random Access Memory, abbreviated as SRAM), a programmable read-only memory (English: Programmable Read Only Memory, abbreviated as PROM), a read-only memory (English: Read Only Memory, abbreviated as ROM), an electrically erasable programmable read-only memory (English: Electrically Erasable Programmable Read-Only Memory, abbreviated as EEPROM), a magnetic memory, a disk, an optical disk, etc. The memory 402 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 402 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0124] By designing and programming the processor 401, the code corresponding to the data exchange method described in the above embodiment can be fixed into the chip, so that the chip can execute the data exchange method when running. Figure 3 The steps of the data exchange method of the embodiment shown are as follows: How to design and program the processor 401 is a technique known to those skilled in the art and will not be described in detail here.

[0125] Based on the same inventive concept, an embodiment of the present application further provides a storage medium, which stores computer instructions. When the computer instructions are executed on a computer, the computer executes the data exchange method discussed above.

[0126] In some possible implementations, various aspects of the data exchange method provided in the present application may also be implemented in the form of a program product, which includes a program code. When the program product is run on an apparatus, the program code is used to enable the control device to execute the steps of the data exchange method according to various exemplary implementations of the present application described above in this specification.

[0127] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0128] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0129] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0130] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0131] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data exchange system, characterized in that: include: A security management center, a data ferry unit, a first database, a first host, a second host, and a second database, wherein the data ferry unit includes a plurality of ferry machines; The security management center is used to perform identity authentication on the first database; The data ferry unit is used to transmit the target data packet from the first host to the second host through the ferry machine after the security management center determines that the identity authentication of the first database is successful, so that the second host transmits the target data packet to the second database; wherein the target data packet is the data packet transmitted by the first database to the first host.

2. The system according to claim 1, characterized in that The first database agent Agent in the first database is used to send an identity data packet to the security management center, so that the security management center performs identity authentication on the first database according to the identity data packet; wherein the identity data packet includes identity information of the first database.

3. The system according to claim 1, characterized in that The security management center is further configured to send a first notification message instructing to open a first receiving network port to the first host after determining that the first database identity authentication is successful; The first host is configured to open the first receiving network port according to the first notification information after receiving the first notification information sent by the security management center; And receive the target data packet sent by the first database through the first receiving network port.

4. The system according to claim 3, characterized in that The security management center is further configured to receive second notification information reported by the first host indicating that the first host has received the target data packet, and send third notification information to the first host indicating closing the first receiving network port according to the second notification information; The first host is used to close the first receiving network port according to the third notification information after receiving the third notification information sent by the security management center.

5. The system according to claim 4, characterized in that The first host is further used to perform integrity and security verification on the target data packet after closing the first receiving network port. If it is determined that the target data packet has passed the verification, a fourth notification message indicating that the target data packet has passed the verification is reported to the security management center.

6. The system according to claim 1, wherein: The security management center is also used to determine the master ferry machine among the multiple ferry machines in the data ferry unit after determining that the first database identity authentication is successful, and install the data ferry program into the system kernel of the master ferry machine, so that the data ferry program controls the master ferry machine to transmit the target data packet from the first host to the second host.

7. The system according to claim 6, characterized in that The data ferry program is used to control the master ferry machine to open the second receiving network port, and control the master ferry machine to receive the target data packet sent by the first host through the second receiving network port; after confirming that the master ferry machine has received the target data packet, control the master ferry machine to close the second receiving network port; as well as Stripping the target data packet from the protocol to obtain a new target data packet; and performing integrity and security verification on the new target data packet; If it is determined that the new target data packet has passed the verification, the main ferry machine is controlled to open the sending network port; The main ferry machine is controlled to transmit the target data packet to the second host through the sending network port, so that the second host transmits the new target data packet to the second database.

8. The system according to claim 7, characterized in that The data ferrying program is further used to close the sending network port after determining that the main ferrying machine has transmitted the new target data packet to the second host.

9. A data exchange method, the method being applied to the data exchange system according to any one of claims 1 to 8, characterized in that: include: The data exchange system performs identity authentication on the first database through the security management center; After the security management center determines that the identity authentication of the first database is successful, the data exchange system transmits the target data packet from the first host to the second host through a ferry machine among multiple ferry machines in the data ferry unit, so that the second host transmits the target data packet to the second database; wherein the target data packet is the data packet transmitted by the first database to the first host.

10. An electronic device, characterized in that: include: Memory, used to store computer programs; The processor is used to implement the method steps described in claim 9 when executing the computer program stored in the memory.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps of claim 9 are implemented.

Images