Network security management system based on big data

Abstract

The invention discloses a network security management system based on big data, which comprises a rule setting module, a data isolation and exchange module and a data confidential operation module, and is characterized in that the rule setting module is used for performing rule setting on data exchange isolation and transmission corresponding to gatekeeper equipment; the data isolation and exchange module is used for performing control and data isolation and exchange; the data secret-related operation module is used for performing encryption authentication operation by using a secret-related intranet, namely performing data exchange isolation setting and corresponding network rule configuration by using a private protocol, and performing deep application identification on a data stream of a task channel; and access among different areas of the gatekeeper equipment is controlled. Meanwhile, data isolation exchange is carried out in a secret key sharing mode; finally, the data subjected to security isolation and exchange are transmitted in a one-way mode according to the time sequence, encryption authentication operation is carried out through a secret-related intranet, and the method has the advantages of improving the security performance strength and reducing the attack risk.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security management system based on big data. Background Art

[0002] A network gate, also known as a network security isolation device, is a professional hardware that is set up between two unconnected networks. It completes the secure transmission of data resources between networks under certain restrictions according to requirements. When the network gate is working, it will go through a process of stripping-detection-repackaging. First, the data packet will be stripped and decomposed, and then the static raw data will be subject to security review. It will then be encapsulated with a special internal protocol and forwarded. After reaching the peer network, it will be re-encapsulated according to TCP / IP. The technical limitations and conventional confidentiality of the data stored in the intranet file server and database make the data transmission process less compatible, which leads to security vulnerabilities in network isolation products and DoS / DDS attacks, allowing network attackers to bypass physical noise isolation measures by constructing malicious data documents, thereby causing the internal network to be attacked. Therefore, it is necessary to design a network security management system based on big data to improve security performance and reduce attack risks. Summary of the invention

[0003] The purpose of the present invention is to provide a network security management system based on big data to solve the problems raised in the above background technology.

[0004] In order to solve the above technical problems, the present invention provides the following technical solutions: a network security management system based on big data, comprising a rule setting module, a data isolation exchange module, and a data confidential operation module, characterized in that: the rule setting module is used to set rules for data exchange isolation and transmission corresponding to the network gate device; the data isolation exchange module is used to control and perform data isolation exchange; the data confidential operation module is used to perform encryption and authentication operations using a confidential intranet, and the rule setting module is electrically connected to the data isolation exchange module and the data confidential operation module.

[0005] According to the above technical solution, it includes: a data depth identification module, a control command identification module, and a transmission rule setting module. The data depth identification module is used to perform deep application identification on the data flow of the task channel; the control command identification module is used to identify control commands according to security policies; the transmission rule setting module is used to set transmission rules between data of network gateway devices, and the data depth identification module is electrically connected to the control command identification module and the transmission rule setting module.

[0006] According to the above technical solution, the data isolation exchange module includes: a data access module, an access control module, and a priority arrangement module. The data access module is used to obtain the connection object through connection attributes for data access; the access control module is used to perform data access control; the priority arrangement module is used to set priority arrangement in the process of transmitting application data between the external network and the internal network; the isolation exchange module is used for the isolation exchange end of the application data to perform isolated exchange by sharing a key, and the data access module is connected to the access control module and the priority arrangement module through a network.

[0007] According to the above technical solution, the data confidential operation module includes: an identity authentication module, a data analysis module, a connection transmission module, and a connection transmission blocking module. The identity authentication module is used for secure isolation and connection and identity authentication with the data sorting and pushing end according to the interface regulations; the data analysis module is used to unpack and analyze data packets that comply with the authorized transmission rules; the connection transmission module is used to access the data interface provided by the destination confidential internal network to initiate connection transmission; the connection transmission blocking module is used to block access and connection transmission of data that is not accessed through the data interface provided by the destination confidential internal network and data access that has not passed identity authentication. The identity authentication module, data analysis module, connection transmission module, and connection transmission blocking module are interconnected in the network.

[0008] According to the above technical solution, the operating method of the system includes the following steps: Step 1: The network gate device uses a private protocol to set up data exchange isolation, divides different network areas through the configuration of network rules, and performs in-depth application identification on the data flow of the task channel; Step 2: Control access between different areas of the network gate device; Step 3: Data isolation exchange through shared keys; Step 3: Transmit the data that has been securely isolated and exchanged in a one-way manner in a time sequence, and use the confidential intranet to perform encryption and authentication operations.

[0009] According to the above technical solution, the method for data exchange, identification and isolation includes the following steps: Step 11: Using a storage medium with an independent control circuit, two hosts are used to construct a three-module architecture. The hosts distinguish control data and application data through an application protocol, identify control commands according to security policies, define port task channels based on application protocols, and determine whether the actual data flow with the accompanying application protocol is the application data corresponding to the application protocol defined by the port task channel. When the determination result is yes, unidirectional transmission control is performed according to the identified control command. When the determination result is no, the connection of the port task channel is blocked. Step 12: Set a fixed time period at both ends of the network gate, and set that only the data of the authorized host can be connected and transmitted, and only one network can be connected at a time, and the other network is disconnected; Step 13: When performing unidirectional transmission control, data is exchanged in partitions based on the storage device shared by both parties of the unidirectional transmission control, and the internal and external network processing units are not directly connected by using the network gate switch, and the data is exchanged only through the divided time periods; Step 14: The external network host converts the data to be transmitted to the internal network into a set file format through a conversion agent. The file is transmitted to the external network interface through the transmission agent. The data is transmitted through the external network interface and the internal network interface and the isolation switch in the middle. The data after the security encryption test is converted into original data by the conversion agent, and then the internal network server determines whether the data is safe. When it passes the security encryption test, it is transmitted to the internal network host. When it does not pass the security data test, it is blocked and an alarm is issued.

[0010] According to the above technical solution, the method for controlling data access between different areas includes the following steps: Step 21: The consistency of application data is controlled by using a data exchange unit. After the storage mode of the database is switched, the original data is migrated to the latest data source to form data consistency. The data is further differentiated according to the storage mode, and the data is placed on different database servers in the form of blocks. The connection object is obtained through the connection attribute to access the data, and the database server configuration information is dynamically managed. An alarm mechanism is triggered for inaccessible database servers. Step 22: Group the application data according to the set principles, implement data flow control through the inter-group strategy, and group the entities carrying services of servers and virtual machines using the grouping strategy of IP addresses and MAC addresses. The control unit is in an idle state by default, and all electronic switches in the internal and external networks are turned on. Step 23: When the intranet processing unit wants to send data to the external network, the intranet processing unit sends the data with the general protocol removed through the interface. When the conversion methods of the internal and external network databases are different, the application data is fragmented, and only the amount of data within the acceptable range of the data control card is transmitted each time. The fragmented data is then compressed using an efficient compression algorithm, and the compressed data is signed at the same time, and the transmission header information is added to the signature data to ensure that the fragmented information can be successfully reorganized into application data after the intranet receives the data.

[0011] According to the above technical solution, the method for performing data isolation exchange includes the following steps: Step 31: During the process of transmitting application data between the external network and the internal network, a priority arrangement is set. When there is a request to transmit data to the other network at the same time, the priority arrangement is executed; Step 32: The isolated exchange end of application data only trusts and allows data submitted by the dedicated driver of the intranet through a dedicated security protocol by means of a shared key. The dedicated driver of the intranet only trusts and allows the set server-side program to call the data transmission interface provided by it through a kernel-level security control method. The server-side program only trusts and allows the authorized client and the client that calls the security interface to exchange data with other trusted clients through authentication and access control methods. Step 33: When data is transmitted from the external network to the internal network, the external network host sends a request to the isolation switch. When permission is obtained, the isolation switch triggers the electronic switch to connect with the external network host by setting a command, and the electronic switch connected to the internal network is disconnected, and the isolation switch receives the application data from the external network; Step 34: When the application data transmission is completed, the isolation switch uses an electronic switch to disconnect from the internal and external networks, and performs risk detection on the application data. After controlling the electronic switch connected to the internal network to be turned on, the application data after risk detection is transmitted to the internal network.

[0012] According to the above technical solution, the method of using a confidential intranet to perform encryption operations includes the following steps: Step 41: At the confidential internal network end, the security isolation and data one-way transmission end connects and authenticates with the data sorting and pushing end according to the interface regulations, and performs security checks and integrity checks on the received data packets, and performs data encryption and blocking operations based on the inspection results. When the inspection result of the data packet meets the authorized transmission rules, step 42 is performed. When the inspection result of the data packet does not meet the authorized transmission rules, the transmission is blocked; Step 42: For data packets whose inspection results comply with the authorization transmission rules, unpack, analyze and control the data flow, access the data interface provided by the destination confidential internal network to initiate a connection, and perform further identity authentication. The data is controlled according to the results of the access and the identity authentication. If the data packet is accessed through the data interface provided by the destination confidential internal network and the identity authentication is passed, the data packet is transmitted; if the data interface provided by the destination confidential internal network is not accessed or the identity authentication is not passed, the access and connection transmission are blocked.

[0013] According to the above technical solution, the identity authentication includes user name and password authentication and domain user integrated authentication. When a user attempts to access a confidential internal network, the identity authentication information provided by the user is compared with a pre-stored user database to verify the user's identity and authority. Whether the user is allowed to access is determined based on the user's identity authentication result. The user's authority is compared with the access policy set in the database corresponding to the authority to see if it matches. Based on the comparison result, the user's access is executed or blocked.

[0014] Compared with the prior art, the beneficial effects achieved by the present invention are as follows: the present invention, by providing a rule setting module, a data isolation exchange module, and a data confidential operation module, performs data exchange isolation settings and corresponding network rule configuration using a private protocol, performs deep application identification on the data flow of the task channel; and controls access between different areas of the network gate device; at the same time, performs data isolation exchange by means of a shared key; finally, the data that has undergone secure isolation exchange is transmitted unidirectionally in a time sequence, and encryption authentication operations are performed using a confidential intranet, thereby achieving the function of not being able to access the external network when being able to access the intranet, and not being able to access the intranet when being able to access the external network. When the network is attacked by a virus or maliciously by a hacker, the network gate can quickly disconnect from the external network to protect the data security of the internal network. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings: Figure 1 A schematic diagram of the module composition of a network security management system based on big data provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0017] Embodiment 1: This embodiment can be applied to the scenario of network security isolation device security management, which is implemented by a network security management system based on big data provided by this embodiment, such as Figure 1 As shown, the method of the system specifically includes the following steps: Step 1: The network gate device uses a private protocol to set up data exchange isolation, divides different network areas through the configuration of network rules, and performs in-depth application identification on the data flow of the task channel; Step 2: Control access between different areas of the network gate device; Step 3: Data isolation exchange through shared keys; Step 3: Transmit the data that has been securely isolated and exchanged in a one-way manner in a time sequence, and use the confidential intranet to perform encryption and authentication operations.

[0018] In an embodiment of the present invention, the method for exchanging, identifying and isolating data includes the following steps: Step 11: Using a storage medium with an independent control circuit, two hosts are used to construct a three-module architecture. The hosts distinguish control data and application data through an application protocol, identify control commands according to security policies, define port task channels based on application protocols, and determine whether the actual data flow with the accompanying application protocol is the application data corresponding to the application protocol defined by the port task channel. When the determination result is yes, unidirectional transmission control is performed according to the identified control command. When the determination result is no, the connection of the port task channel is blocked. Step 12: Set a fixed time period at both ends of the network gate, and set that only the data of the authorized host can be connected and transmitted, and only one network can be connected at a time, and the other network is disconnected; Step 13: When performing unidirectional transmission control, data is exchanged in partitions based on the storage device shared by both parties of the unidirectional transmission control, and the internal and external network processing units are not directly connected by using the network gate switch, and the data is exchanged only through the divided time periods; Step 14: The external network host converts the data to be transmitted to the internal network into a set file format through a conversion agent. The file is transmitted to the external network interface through the transmission agent. The data is transmitted through the external network interface and the internal network interface and the isolation switch in the middle. The data after the security encryption test is converted into original data by the conversion agent, and then the internal network server determines whether the data is safe. When it passes the security encryption test, it is transmitted to the internal network host. When it does not pass the security data test, it is blocked and an alarm is issued.

[0019] In an embodiment of the present invention, a method for controlling data access between different areas includes the following steps: Step 21: The consistency of application data is controlled by using a data exchange unit. After the storage mode of the database is switched, the original data is migrated to the latest data source to form data consistency. The data is further differentiated according to the storage mode, and the data is placed on different database servers in the form of blocks. The connection object is obtained through the connection attribute to access the data, and the database server configuration information is dynamically managed. An alarm mechanism is triggered for inaccessible database servers. Step 22: Group the application data according to the set principle, implement data flow control through the inter-group strategy, and group the entities carrying services of servers and virtual machines using the grouping strategy of IP addresses and MAC addresses. The control unit is in an idle state by default, and all electronic switches in the internal and external networks are turned on. Step 23: When the intranet processing unit wants to send data to the external network, the intranet processing unit sends the data with the general protocol removed through the interface. When the conversion methods of the internal and external network databases are different, the application data is fragmented, and only the amount of data within the acceptable range of the data control card is transmitted each time. The fragmented data is then compressed using an efficient compression algorithm, and the compressed data is signed at the same time, and the transmission header information is added to the signature data to ensure that the fragmented information can be successfully reorganized into application data after the intranet receives the data.

[0020] In an embodiment of the present invention, the method for performing data isolation exchange includes the following steps: Step 31: During the process of transmitting application data between the external network and the internal network, a priority arrangement is set. When there is a request to transmit data to the other network at the same time, the priority arrangement is executed; Step 32: The isolated exchange end of application data only trusts and allows data submitted by the dedicated driver of the intranet through a dedicated security protocol by means of a shared key. The dedicated driver of the intranet only trusts and allows the set server-side program to call the data transmission interface provided by it through a kernel-level security control method. The server-side program only trusts and allows the authorized client and the client that calls the security interface to exchange data with other trusted clients through authentication and access control methods. Step 33: When data is transmitted from the external network to the internal network, the external network host sends a request to the isolation switch. When permission is obtained, the isolation switch triggers the electronic switch to connect with the external network host by setting a command, and the electronic switch connected to the internal network is disconnected, and the isolation switch receives the application data from the external network; Step 34: When the application data transmission is completed, the isolation switch uses an electronic switch to disconnect from the internal and external networks, and performs risk detection on the application data. After controlling the electronic switch connected to the internal network to be turned on, the application data after risk detection is transmitted to the internal network.

[0021] In an embodiment of the present invention, the method for performing encryption operation using a confidential intranet includes the following steps: Step 41: At the confidential internal network end, the security isolation and data one-way transmission end connects and authenticates with the data sorting and pushing end according to the interface regulations, and performs security checks and integrity checks on the received data packets, and performs data encryption and blocking operations according to the inspection results. When the inspection result of the data packet meets the authorization transmission rules, step 42 is performed. When the inspection result of the data packet does not meet the authorization transmission rules, the transmission is blocked; the identity authentication includes user name and password authentication and domain user integrated authentication. When a user attempts to access the confidential internal network, the identity authentication information provided by the user is compared with the pre-stored user database to verify the user's identity and authority. Whether the user is allowed to access is determined based on the user's identity authentication result. Whether the access policy set corresponding to the authority in the database matches the user's authority is compared, and the user's access is executed or blocked based on the comparison result; Step 42: For data packets whose inspection results comply with the authorization transmission rules, unpack, analyze and control the data flow, access the data interface provided by the destination confidential internal network to initiate a connection, and perform further identity authentication. The data is controlled according to the results of the access and the identity authentication. If the data packet is accessed through the data interface provided by the destination confidential internal network and the identity authentication is passed, the data packet is transmitted; if the data interface provided by the destination confidential internal network is not accessed or the identity authentication is not passed, the access and connection transmission are blocked.

[0022] Embodiment 2: Embodiment 2 of the present invention provides a network security management system based on big data. Figure 1 A schematic diagram of the module composition of a network security management system based on big data provided in the second embodiment of the present invention, such as Figure 1 As shown, the system includes: A rule setting module is used to set rules for data exchange isolation and transmission corresponding to the network gate device; Data isolation exchange module, used for control and data isolation exchange; The data confidential operation module is used to perform encryption and authentication operations using the confidential intranet.

[0023] In some embodiments of the present invention, the rule setting module includes: The data deep identification module is used to perform deep application identification on the data stream of the task channel; A control command identification module, used to identify control commands according to security policies; The transmission rule setting module is used to set the transmission rules between data of network gate devices.

[0024] In some embodiments of the present invention, the data isolation exchange module includes: Data access module, used to obtain connection objects through connection properties for data access; Access control module, used for data access control; The priority arrangement module is used to set the priority arrangement in the process of transmitting application data between the external network and the internal network; The isolated exchange module is used for the isolated exchange end of application data to perform isolated exchange by sharing keys.

[0025] In some embodiments of the present invention, the data confidentiality operation module includes: Identity authentication module, used for secure isolation and data one-way transmission end to connect and authenticate with the data sorting and pushing end according to interface regulations; A data analysis module is used to unpack and analyze data packets that comply with the authorized transmission rules; A connection transmission module is used to access the data interface provided by the target confidential internal network to initiate connection transmission; The connection transmission blocking module is used to block access to data interfaces that are not provided by the target confidential internal network, as well as data access that has not passed identity authentication and connection transmission.

[0026] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device.

[0027] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security management system based on big data, including a rule setting module, a data isolation exchange module, and a data confidential operation module, characterized in that: The rule setting module is used to set rules for data exchange isolation and transmission corresponding to the network gate device; the data isolation exchange module is used to control and perform data isolation exchange; the data confidential operation module is used to perform encryption and authentication operations using a confidential intranet, and the rule setting module is electrically connected to the data isolation exchange module and the data confidential operation module.

2. A network security management system based on big data according to claim 1, characterized in that: The rule setting module includes: a data depth identification module, a control command identification module, and a transmission rule setting module. The data depth identification module is used to perform deep application identification on the data flow of the task channel; the control command identification module is used to identify control commands according to security policies; the transmission rule setting module is used to set transmission rules between data of network gate devices, and the data depth identification module is electrically connected to the control command identification module and the transmission rule setting module.

3. A network security management system based on big data according to claim 2, characterized in that: The data isolation exchange module includes: a data access module, an access control module, and a priority arrangement module. The data access module is used to obtain the connection object through connection attributes for data access; the access control module is used to perform data access control; the priority arrangement module is used to set priority arrangement in the process of transmitting application data between the external network and the internal network; the isolation exchange module is used for the isolation exchange end of the application data to perform isolated exchange by sharing a key, and the data access module is connected to the access control module and the priority arrangement module through a network.

4. A network security management system based on big data according to claim 3, characterized in that: The data confidential operation module includes: an identity authentication module, a data analysis module, a connection transmission module, and a connection transmission blocking module. The identity authentication module is used for secure isolation and connection and identity authentication with the data sorting and pushing end according to the interface regulations; the data analysis module is used to unpack and analyze data packets that comply with the authorized transmission rules; the connection transmission module is used to access the data interface provided by the destination confidential internal network to initiate connection transmission; the connection transmission blocking module is used to block access and connection transmission of data that is not accessed through the data interface provided by the destination confidential internal network and data access that has not passed identity authentication. The identity authentication module, data analysis module, connection transmission module, and connection transmission blocking module are interconnected in the network.

5. A network security management system based on big data according to claim 4, characterized in that: The operation method of the system comprises the following steps: Step 1: The network gate device uses a private protocol to set up data exchange isolation, divides different network areas through the configuration of network rules, and performs in-depth application identification on the data flow of the task channel; Step 2: Control access between different areas of the network gate device; Step 3: Data isolation exchange through shared keys; Step 3: Transmit the data that has been securely isolated and exchanged in a one-way manner in a time sequence, and use the confidential intranet to perform encryption and authentication operations.

6. A network security management system based on big data according to claim 5, characterized in that: The method for data exchange, identification and isolation comprises the following steps: Step 11: Using a storage medium with an independent control circuit, two hosts are used to construct a three-module architecture. The hosts distinguish control data and application data through an application protocol, identify control commands according to security policies, define port task channels based on application protocols, and determine whether the actual data flow with the accompanying application protocol is the application data corresponding to the application protocol defined by the port task channel. When the determination result is yes, unidirectional transmission control is performed according to the identified control command. When the determination result is no, the connection of the port task channel is blocked. Step 12: Set a fixed time period at both ends of the network gate, and set that only the data of the authorized host can be connected and transmitted, and only one network can be connected at a time, and the other network is disconnected; Step 13: When performing unidirectional transmission control, data is exchanged in partitions based on the storage device shared by both parties of the unidirectional transmission control, and the internal and external network processing units are not directly connected by using the network gate switch, and are only exchanged in divided time periods; Step 14: The external network host converts the data to be transmitted to the internal network into a set file format through a conversion agent. The file is transmitted to the external network interface through the transmission agent. The data is transmitted through the external network interface and the internal network interface and the isolation switch in the middle. The data after the security encryption test is converted into original data by the conversion agent, and then the internal network server determines whether the data is safe. When it passes the security encryption test, it is transmitted to the internal network host. When it does not pass the security data test, it is blocked and an alarm is issued.

7. A network security management system based on big data according to claim 6, characterized in that: The method for controlling data access between different areas comprises the following steps: Step 21: The consistency of application data is controlled by using a data exchange unit. After the storage mode of the database is switched, the original data is migrated to the latest data source to form data consistency. The data is further differentiated according to the storage mode, and the data is placed on different database servers in the form of blocks. The connection object is obtained through the connection attribute to access the data, and the database server configuration information is dynamically managed. An alarm mechanism is triggered for inaccessible database servers. Step 22: Group the application data according to the set principle, implement data flow control through the inter-group strategy, and group the entities carrying services of servers and virtual machines using the grouping strategy of IP addresses and MAC addresses. The control unit is in an idle state by default, and all electronic switches in the internal and external networks are turned on. Step 23: When the intranet processing unit wants to send data to the external network, the intranet processing unit sends the data with the general protocol removed through the interface. When the conversion methods of the internal and external network databases are different, the application data is fragmented, and only the amount of data within the acceptable range of the data control card is transmitted each time. The fragmented data is then compressed using an efficient compression algorithm, and the compressed data is signed at the same time, and the transmission header information is added to the signature data to ensure that the fragmented information can be successfully reorganized into application data after the intranet receives the data.

8. A network security management system based on big data according to claim 7, characterized in that: The method for performing data isolation exchange comprises the following steps: Step 31: During the process of transmitting application data between the external network and the internal network, a priority arrangement is set. When there is a request to transmit data to the other network at the same time, the priority arrangement is executed; Step 32: The isolated exchange end of application data only trusts and allows data submitted by the dedicated driver of the intranet through a dedicated security protocol by means of a shared key. The dedicated driver of the intranet only trusts and allows the set server-side program to call the data transmission interface provided by it through a kernel-level security control method. The server-side program only trusts and allows the authorized client and the client that calls the security interface to exchange data with other trusted clients through authentication and access control methods. Step 33: When data is transmitted from the external network to the internal network, the external network host sends a request to the isolation switch. When permission is obtained, the isolation switch triggers the electronic switch to connect with the external network host by setting a command, and the electronic switch connected to the internal network is disconnected, and the isolation switch receives the application data from the external network; Step 34: When the application data transmission is completed, the isolation switch uses an electronic switch to disconnect from the internal and external networks, and performs risk detection on the application data. After controlling the electronic switch connected to the internal network to be turned on, the application data after risk detection is transmitted to the internal network.

9. A network security management system based on big data according to claim 8, characterized in that: The method for performing encryption operation using a confidential intranet comprises the following steps: Step 41: At the confidential internal network end, the security isolation and data one-way transmission end connects and authenticates with the data sorting and pushing end according to the interface regulations, and performs security checks and integrity checks on the received data packets, and performs data encryption and blocking operations based on the inspection results. When the inspection result of the data packet meets the authorized transmission rules, step 42 is performed. When the inspection result of the data packet does not meet the authorized transmission rules, the transmission is blocked; Step 42: For data packets whose inspection results comply with the authorization transmission rules, unpack, analyze and control the data flow, access the data interface provided by the destination confidential internal network to initiate a connection, and perform further identity authentication. The data is controlled according to the results of the access and the identity authentication. If the data packet is accessed through the data interface provided by the destination confidential internal network and the identity authentication is passed, the data packet is transmitted; if the data interface provided by the destination confidential internal network is not accessed or the identity authentication is not passed, the access and connection transmission are blocked.

10. A network security management system based on big data according to claim 9, characterized in that: The identity authentication in step 41 includes user name and password authentication and domain user integrated authentication. When a user attempts to access a confidential internal network, the identity authentication information provided by the user is compared with a pre-stored user database to verify the user's identity and authority. Based on the user's identity authentication result, it is determined whether the user is allowed to access. Based on the user's authority, the access policy corresponding to the authority in the database is compared to see if it matches. Based on the comparison result, the user's access is executed or blocked.

Images