Cross-network data transmission system and method and data transmission gatekeeper

Abstract

The embodiment of the invention provides a cross-network data transmission system, a data transmission gatekeeper and a cross-network data transmission method. A first intranet processing module performs identity confirmation on a user system trying to access a resource, and prevents network direct connection with a user system of a first proxy server; performing data stripping processing on the request file data transmitted by the first proxy server, and storing the stripped data in a first intranet data buffer area; the second intranet processing module performs identity confirmation on the user system trying to access the resource, and prevents network direct connection with the user system of the second proxy server; performing data stripping processing on the request file data transmitted by the second proxy server, and storing the stripped data in a second intranet data buffer area; the isolation and exchange control module is used for controlling data exchange between the first intranet data buffer area and the second intranet data buffer area. According to the invention, the security of cross-network data transmission is ensured, and the data transmission efficiency is improved.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular, to a cross-network data transmission system, a cross-network data transmission method, and a data transmission gateway. Background Art

[0002] With the in-depth development of computer technology, more and more data needs to be exchanged between internal networks and external networks, and between internal networks in industries such as finance, medical care, transportation, and government departments. For information security reasons, more and more companies divide their internal networks into multiple independent network areas, and isolate each network area through physical isolation or logical isolation to ensure the security of data within the network area. However, network isolation cannot prevent the need for cross-network data transmission, and companies will have more cross-network transmission needs in their daily operations.

[0003] At present, there are mainly three ways to transmit data across networks. The first is to use removable storage devices (such as USB flash drives, optical disks, mobile hard disks, etc.). These devices are lightweight and low-cost, so they were widely used in cross-network data transmission scenarios of various enterprises in the early days. However, they have problems such as easy virus transmission, easy file damage and theft, inability to uniformly monitor and manage, and inability to transfer large-capacity files across regions. The second is that the FTP service uses binary mode for data transmission, which has a high transmission speed and is suitable for large-scale data transmission. However, it has problems such as low security, poor reliability, and lack of visibility. The third method uses a network gate, which only provides point-to-point exchange of data files, making cross-network data transmission highly secure and reliable, but it is not suitable for large-scale data transmission business scenarios.

[0004] Therefore, there is an urgent need for a solution that can both ensure the secure isolation of important networks from other networks and enable efficient and large-scale data exchange between internal networks. Summary of the invention

[0005] The embodiments described herein provide a cross-network data transmission system, a cross-network data transmission method, and a data transmission gateway, which are intended to improve data transmission efficiency while ensuring the security of cross-network data transmission.

[0006] According to a first aspect of the present disclosure, there is provided a cross-network data transmission system, comprising: a first proxy server, a data transmission gateway, and a second proxy server;

[0007] Wherein, the first proxy server is located in a first local area network, the second proxy server is located in a second local area network, and the data transmission gateway includes a first intranet processing module, an isolation and switching control module, and a second intranet processing module;

[0008] The first intranet processing module is used to connect to the first proxy server, confirm the identity of the user system attempting to access resources, and prevent the user system from directly connecting to the first proxy server through the network; perform data stripping processing on the request file data transmitted by the first proxy server, and store the stripped data in the first intranet data buffer;

[0009] The second intranet processing module is used to connect to the second proxy server, confirm the identity of the user system attempting to access the resource, and prevent the user system from directly connecting to the second proxy server through the network; perform data stripping processing on the request file data transmitted by the second proxy server, and store the stripped data in the second intranet data buffer;

[0010] Two ends of the isolation and exchange control module are respectively connected to the first intranet processing module and the second intranet processing module, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer.

[0011] Optionally, the first proxy server is used to receive a service data request sent by a user system, generate exchangeable request file data based on the service data request, and send the request file data to a data transmission gateway.

[0012] Optionally, the second intranet processing module is used to send the stripped data to the second proxy server using a private protocol.

[0013] Optionally, the second proxy server is an Nginx proxy server cluster, and the second local area network also includes: an application server cluster and a storage server cluster;

[0014] Wherein, the Nginx proxy server cluster is used to send the request file data to the application server cluster;

[0015] The application server cluster obtains corresponding data from the storage server cluster according to the content of the requested file data, and returns the obtained data to the Nginx proxy server cluster to be transmitted to the first proxy server based on the isolation and exchange control module.

[0016] Optionally, the Nginx proxy server cluster includes multiple Nginx proxy servers, multiple application servers are set on each Nginx proxy server, the same weight is configured for each application server, and the Nginx proxy server distributes requests in a polling manner.

[0017] Optionally, verify the identity of the user system attempting to access the resource, including:

[0018] Acquire access request data, wherein the access request data represents request data for a user system to access a resource;

[0019] Extracting the access request data based on the user system identity to obtain request identity data;

[0020] The requested identity identification data is matched with a preset network gate access server database to realize data connection between the user system and the data transmission network gate, wherein, if the preset network gate access server database contains access server data matching the requested identity identification data, the user system is connected to the data transmission network gate; if the preset network gate access server database does not contain access server data matching the requested identity identification data, the user system is not connected to the data transmission network gate.

[0021] Optionally, performing data stripping processing on the request file data transmitted by the proxy server and storing the stripped data in the data buffer includes:

[0022] Performing application protocol-based elimination processing on the request file data transmitted by the proxy server to obtain gatekeeper transmission data, wherein the gatekeeper transmission data is used to represent the request file data after the proxy server application protocol is eliminated;

[0023] The gateway transmission data is encapsulated in a private protocol, wherein the private protocol is a protocol preset by the data transmission gateway.

[0024] According to a second aspect of the present disclosure, there is provided a data transmission network gatekeeper, comprising: a first intranet processing module, an isolation and switching control module and a second intranet processing module;

[0025] The first intranet processing module is used to connect to the first proxy server, confirm the identity of the user system attempting to access the resource, and prevent the user system from directly connecting to the first proxy server through the network; perform data stripping processing on the request file data transmitted by the first proxy server, and store the stripped data in the first intranet data buffer;

[0026] The second intranet processing module is used to connect to the second proxy server, confirm the identity of the user system attempting to access the resource, and prevent the user system from directly connecting to the second proxy server through the network; perform data stripping processing on the request file data transmitted by the second proxy server, and store the stripped data in the second intranet data buffer;

[0027] Two ends of the isolation and exchange control module are respectively connected to the first intranet processing module and the second intranet processing module, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer;

[0028] The first proxy server is located in a first local area network, and the second proxy server is located in a second local area network.

[0029] According to a third aspect of the present disclosure, a cross-network data transmission method is provided, including:

[0030] The first proxy server receives a service data request sent by a user system, generates exchangeable request file data based on the service data request, and sends the request file data to the data transmission network gate; wherein the first proxy server is located in the first local area network;

[0031] The data transmission network gatekeeper confirms the identity of the user system attempting to access the resource, and blocks the direct network connection with the user system of the first proxy server;

[0032] The data transmission network gate performs data stripping processing on the request file data transmitted by the first proxy server, and sends the stripped data to the second proxy server; wherein the second proxy server is located in the second local area network.

[0033] Optionally, the second proxy server is an Nginx proxy server cluster, and after sending the stripped data to the second proxy server, the method further includes:

[0034] The Nginx proxy server cluster is used to send the request file data to the application server cluster;

[0035] The application server cluster obtains corresponding data from the storage server cluster according to the content of the requested file data, and returns the obtained data to the Nginx proxy server cluster to be transmitted to the first proxy server based on the isolation and exchange control module.

[0036] Optionally, the data transmission network gate performs data stripping processing on the request file data transmitted by the first proxy server, and sends the stripped data to the second proxy server, comprising:

[0037] The first intranet processing module confirms the identity of the user system attempting to access the resource, and blocks the direct network connection with the user system of the first proxy server; performs data stripping processing on the request file data transmitted by the first proxy server, and stores the stripped data in the first intranet data buffer;

[0038] The isolation and exchange control module obtains the data in the first intranet data buffer, encapsulates the data and sends it to the second intranet processing module;

[0039] The second intranet processing module obtains the data transmitted by the isolation and exchange control module, and sends the data to the second proxy server through the intranet interface.

[0040] Optionally, the second intranet processing module sending the data to the second proxy server through the intranet interface includes: the second intranet processing module sending the data to the second proxy server through the intranet interface using a private protocol.

[0041] The cross-network data transmission system provided by the present application has a first proxy server located in a first local area network, and a second proxy server located in a second local area network. The first intranet processing module performs identity confirmation on the user system attempting to access resources, and prevents direct network connection with the user system of the first proxy server; performs data stripping processing on the request file data transmitted by the first proxy server, and stores the stripped data in the first intranet data buffer; the second intranet processing module performs identity confirmation on the user system attempting to access resources, and prevents direct network connection with the user system of the second proxy server; performs data stripping processing on the request file data transmitted by the second proxy server, and stores the stripped data in the second intranet data buffer; the two ends of the isolation and exchange control module are respectively connected to the first intranet processing module and the second intranet processing module, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer. The present application strips the transmission data between the two intranets into pure data through a data transmission network gate, and performs bidirectional ferrying, and uses a bidirectional proxy server to load the transmission data, thereby ensuring the security of cross-network data transmission and improving the data transmission efficiency, solving the problem that the existing cross-network data transmission technology cannot take into account both data security and large-scale data transmission efficiency. In addition, the present application also provides a data transmission gateway and a cross-network data transmission method having the above-mentioned technical effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments will be briefly described below. It should be noted that the drawings described below only relate to some embodiments of the present disclosure, but are not intended to limit the present disclosure, wherein:

[0043] Figure 1 It is a structural block diagram of a specific implementation method of the cross-network data transmission system provided by the present application;

[0044] Figure 2 It is a structural block diagram of another specific implementation of the cross-network data transmission system provided by the present application;

[0045] Figure 3 It is a structural block diagram of the data transmission network gateway provided by this application;

[0046] Figure 4 This is a workflow diagram of a specific implementation of the cross-network data transmission method provided by the present application;

[0047] Figure 5 It is a workflow diagram of another specific implementation method of the cross-network data transmission method provided by the present application.

[0048] The elements in the drawings are schematic and not drawn to scale. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution of the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present disclosure, rather than all of the embodiments. Based on the described embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative work also fall within the scope of protection of the present disclosure.

[0050] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by those skilled in the art to which the disclosed subject matter belongs. It will be further understood that terms such as those defined in commonly used dictionaries should be interpreted as having meanings consistent with their meanings in the context of the specification and the relevant technology, and will not be interpreted in an idealized or overly formal form unless otherwise clearly defined herein. Terms such as "first" and "second" are only used to distinguish one element (or a portion of an element) from another element (or another portion of an element).

[0051] The embodiments of the present disclosure provide a cross-network data transmission system, such as Figure 1 As shown in a structural block diagram of a specific implementation method of the cross-network data transmission system provided in the present application, the system specifically includes: a first proxy server 11, a data transmission gateway 12 and a second proxy server 13; wherein, the first proxy server 11 is located in a first local area network, the second proxy server 13 is located in a second local area network, and the data transmission gateway 12 includes a first intranet processing module 121, an isolation and switching control module 122 and a second intranet processing module 123.

[0052] The first intranet processing module 121 is used to connect to the first proxy server 11, confirm the identity of the user system attempting to access resources, and prevent direct network connection with the user system of the first proxy server 11; perform data stripping processing on the request file data transmitted by the first proxy server 11, and store the stripped data in the first intranet data buffer.

[0053] The second intranet processing module 123 is used to connect to the second proxy server 13, confirm the identity of the user system attempting to access resources, and prevent direct network connection with the user system of the second proxy server 13; perform data stripping processing on the request file data transmitted by the second proxy server 13, and store the stripped data in the second intranet data buffer.

[0054] Both ends of the isolation and exchange control module 122 are connected to the first intranet processing module 121 and the second intranet processing module 123 respectively, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer.

[0055] It can be understood that the first proxy server 11 is used to receive a service data request sent by a user system, generate exchangeable request file data based on the service data request, and send the request file data to the data transmission gateway 12 .

[0056] The second intranet processing module 123 is used to send the stripped data to the second proxy server 13 using a private protocol.

[0057] The cross-network data transmission system provided by the present application has a first proxy server located in a first local area network, and a second proxy server located in a second local area network. The first intranet processing module performs identity confirmation on the user system attempting to access resources, and prevents direct network connection with the user system of the first proxy server; performs data stripping processing on the request file data transmitted by the first proxy server, and stores the stripped data in the first intranet data buffer; the second intranet processing module performs identity confirmation on the user system attempting to access resources, and prevents direct network connection with the user system of the second proxy server; performs data stripping processing on the request file data transmitted by the second proxy server, and stores the stripped data in the second intranet data buffer; the two ends of the isolation and exchange control module are respectively connected to the first intranet processing module and the second intranet processing module, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer. The present application strips the transmission data between the two intranets into pure data through a data transmission network gate, and performs bidirectional ferrying, and uses a bidirectional proxy server to load the transmission data, thereby ensuring the security of cross-network data transmission and improving the data transmission efficiency, solving the problem that the existing cross-network data transmission technology cannot take into account both data security and large-scale data transmission efficiency.

[0058] An embodiment of the present disclosure provides a cross-network data transmission system for performing identity confirmation on a user system attempting to access resources, including: obtaining access request data, wherein the access request data represents request data of the user system requesting to access resources; performing extraction processing on the access request data based on the user system identity to obtain request identity data; matching the request identity data with a preset network gate access server database to achieve data connection between the user system and the data transmission network gate, wherein if the preset network gate access server database contains access server data matching the request identity data, the user system is connected to the data transmission network gate; if the preset network gate access server database does not contain access server data matching the request identity data, the user system is not connected to the data of the data transmission network gate.

[0059] An embodiment of the present disclosure provides a cross-network data transmission system, which performs data stripping processing on the request file data transmitted by the proxy server, and stores the stripped data in a data buffer, including: performing application protocol-based removal processing on the request file data transmitted by the proxy server to obtain network gate transmission data, wherein the network gate transmission data is used to represent the request file data after the proxy server application protocol is removed; and encapsulating the network gate transmission data with a private protocol, wherein the private protocol is a protocol preset by the data transmission network gate.

[0060] Based on the above embodiment, the present application also provides another specific implementation of the cross-network data transmission system. In this embodiment, the first proxy server is a hardware proxy server, and the second proxy server is an Nginx proxy server cluster. The second local area network also includes: an application server cluster and a storage server cluster. Figure 2 As shown in the structural block diagram of another specific implementation of the cross-network data transmission system provided in the present application, the system specifically includes: a user system 20, a hardware proxy server 21, a data transmission network gate 12, an Nginx proxy server cluster 23, an application server cluster 24 and a storage server cluster 25.

[0061] The hardware proxy server 21 and the user system 20 are located in the first local area network. The Nginx proxy server cluster 23, the application server cluster 24 and the storage server cluster 25 are located in the second local area network. The storage server cluster 25 may specifically include a cloud storage server cluster and a FastDFS storage server cluster.

[0062] The data transmission network gate 12 includes a first intranet processing module 121, an isolation and exchange control module 122 and a second intranet processing module 123. The data transmission network gate 12 is configured to specify that the sender and the receiver of the data exchange are respectively the hardware proxy server of the first LAN and the Nginx proxy server cluster of the second LAN.

[0063] The first intranet processing module 121 includes a first intranet interface unit and a first intranet data buffer. The first intranet interface unit is responsible for connecting with the hardware proxy server, completing identity confirmation, blocking the network direct access of the user system of the first local area network, and performing virus detection, firewall, intrusion protection and other security detection on the request file data transmitted by the hardware proxy server to strip out the pure data. The first intranet data buffer stores and schedules the stripped pure data and is responsible for data exchange with the isolation and exchange control module.

[0064] The second intranet processing module 123 includes a second intranet interface unit and a second intranet data buffer. The second intranet interface unit is responsible for connecting to the Nginx proxy server cluster, completing identity confirmation, blocking the network direct access of the user system of the second local area network, and performing virus detection, firewall, intrusion protection and other security detection on the request file data transmitted by the Nginx proxy server cluster to strip out pure data. The second intranet data buffer stores and schedules the stripped pure data and is responsible for data exchange with the isolation and exchange control module. It can be understood that the first intranet processing module 121 and the second intranet processing module 123 have the same structure and function.

[0065] The isolation and exchange control module 122 is the control center of the data transmission network gate isolation control, which controls the opening and closing of the data exchange channel. The isolation and exchange control module 122 forms a physical isolation between the intranets by adopting a private communication method, changes the communication mode between the intranets, and interrupts the network direct connection between the intranets. The isolation and exchange control module 122 includes a data exchange area, which exchanges data with the intranet data buffers in the first intranet processing module 121 and the second intranet processing module 123.

[0066] The Nginx proxy server cluster 23 is used to send the requested file data to the application server cluster 24; the application server cluster 24 obtains the corresponding data from the storage server cluster 25 according to the content of the requested file data, and returns the obtained data to the Nginx proxy server cluster 23, so as to be transmitted to the hardware proxy server 21 based on the isolation and switching control module 122.

[0067] The Nginx proxy server cluster includes multiple Nginx proxy servers, multiple application servers are set on each Nginx proxy server, the same weight is configured for each application server, and the Nginx proxy server distributes requests in a polling manner. Specifically, the number of Nginx proxy server clusters can be set to 3, wherein 10 application service nodes are set on each Nginx proxy server, the same weight is configured for the 10 application service nodes, and the Nginx proxy server distributes requests in a polling manner.

[0068] In addition, the present application also provides a data transmission network gate 12, such as Figure 3 As shown in the structural block diagram of the data transmission network gateway provided in the present application, the network gateway specifically includes: a first intranet processing module 121, an isolation and switching control module 122 and a second intranet processing module 123.

[0069] The first intranet processing module 121 is used to connect to the first proxy server 11, confirm the identity of the user system attempting to access resources, and prevent direct network connection with the user system of the first proxy server 11; perform data stripping processing on the request file data transmitted by the first proxy server 11, and store the stripped data in the first intranet data buffer.

[0070] The second intranet processing module 123 is used to connect to the second proxy server 13, confirm the identity of the user system attempting to access resources, and prevent direct network connection with the user system of the second proxy server 13; perform data stripping processing on the request file data transmitted by the second proxy server 13, and store the stripped data in the second intranet data buffer.

[0071] Both ends of the isolation and exchange control module 122 are connected to the first intranet processing module 121 and the second intranet processing module 123 respectively, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer.

[0072] The first proxy server is located in a first local area network, and the second proxy server is located in a second local area network.

[0073] In addition, the present application also provides a cross-network data transmission method, referring to Figure 4 A working diagram of a specific implementation of the cross-network data transmission method provided in the present application, the method specifically includes:

[0074] S401: A first proxy server receives a service data request sent by a user system, generates exchangeable request file data based on the service data request, and sends the request file data to a data transmission gateway; wherein the first proxy server is located in a first local area network.

[0075] S402: The data transmission network gatekeeper confirms the identity of the user system attempting to access the resource, and blocks the direct network connection with the user system of the first proxy server.

[0076] S403: The data transmission gateway performs data stripping processing on the request file data transmitted by the first proxy server, and sends the stripped data to the second proxy server; wherein the first proxy server is located in the first local area network.

[0077] Reference Figure 5 Another specific implementation method of the cross-network data transmission method provided in the present application is a flowchart of a working method, wherein the method specifically includes:

[0078] S501: The user system of the first local area network sends a service data request to a hardware proxy server.

[0079] S502: The hardware proxy server converts the service data request into exchangeable request file data, and sends the request file data to the data transmission gateway.

[0080] S503: The data transmission network gate performs identity confirmation and security detection on the hardware proxy server, then strips the file data into pure data, and sends the data to the Nginx proxy server cluster in the second local area network using a private protocol.

[0081] Specifically, the first intranet processing module in the data transmission network gate completes the identity confirmation and security detection of the hardware proxy server, then strips the file data into pure data, and sends the data to the isolation and exchange control module.

[0082] The isolation and exchange control module in the data transmission network gate obtains the data of the first intranet processing module, uses a private protocol to encapsulate the data and sends it to the second intranet processing module in the data transmission network gate.

[0083] The second intranet processing module in the data transmission network gate obtains the data transmitted by the isolation and exchange control module, and sends the data to the second local area network through its internal intranet interface unit.

[0084] S504: The Nginx proxy server cluster sends the requested file data to the application server cluster in a polling manner.

[0085] S505: The application server cluster obtains corresponding data from the storage server cluster according to the content of the requested file data.

[0086] S506: The storage server cluster returns the request result data to the application server cluster.

[0087] S507: The application server cluster returns the result data layer by layer upward according to the request sequence.

[0088] The cross-network data transmission method provided by the present application uses a data transmission network gate to strip the file data between the intranets into pure data and then transfer them in both directions, thereby preventing the applications between the intranets from interconnecting through application protocols, so that intrusions and attacks completely lose their propagation carriers, thereby ensuring the security of cross-network data transmission; by using a two-way proxy server to load the transmitted data, the problem that the data transmission network gate only provides point-to-point data exchange services is improved, and the transmission of large amounts of data is realized.

[0089] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device and method according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, a program segment or an instruction, and a part of the module, a program segment or an instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0090] Unless the context clearly indicates otherwise, the singular form of the words used herein and in the appended claims includes the plural and vice versa. Thus, when referring to the singular, the plural form of the corresponding term is generally included. Similarly, the words "comprise" and "include" are to be interpreted as inclusive rather than exclusive. Likewise, the terms "include" and "or" should be interpreted as inclusive unless such interpretation is expressly prohibited herein. Where the term "example" is used herein, particularly when it is located after a group of terms, the "example" is merely exemplary and illustrative and should not be considered exclusive or comprehensive.

[0091] Further aspects and scopes of adaptability become apparent from the description provided herein. It should be understood that various aspects of the present application can be implemented individually or in combination with one or more other aspects. It should also be understood that the description and specific embodiments herein are intended for purposes of illustration only and are not intended to limit the scope of the present application.

[0092] Several embodiments of the present disclosure are described in detail above, but it is obvious that those skilled in the art can make various modifications and variations to the embodiments of the present disclosure without departing from the spirit and scope of the present disclosure. The protection scope of the present disclosure is defined by the attached claims.

Claims

1. A cross-network data transmission system, characterized in that: include: A first proxy server, a data transmission gateway, and a second proxy server; Wherein, the first proxy server is located in a first local area network, the second proxy server is located in a second local area network, and the data transmission gateway includes a first intranet processing module, an isolation and switching control module, and a second intranet processing module; The first intranet processing module is used to connect to the first proxy server, confirm the identity of the user system attempting to access resources, and prevent the user system from directly connecting to the first proxy server through the network; perform data stripping processing on the request file data transmitted by the first proxy server, and store the stripped data in the first intranet data buffer; The second intranet processing module is used to connect to the second proxy server, confirm the identity of the user system attempting to access the resource, and prevent the user system from directly connecting to the second proxy server through the network; perform data stripping processing on the request file data transmitted by the second proxy server, and store the stripped data in the second intranet data buffer; Two ends of the isolation and exchange control module are respectively connected to the first intranet processing module and the second intranet processing module, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer.

2. The inter-network data transmission system according to claim 1, characterized in that: The first proxy server is used to receive a service data request sent by a user system, generate exchangeable request file data based on the service data request, and send the request file data to a data transmission gateway.

3. The inter-network data transmission system according to claim 1, characterized in that: The second intranet processing module is used to send the stripped data to the second proxy server using a private protocol.

4. The inter-network data transmission system according to any one of claims 1 to 3, characterized in that: The second proxy server is an Nginx proxy server cluster, and the second local area network also includes: an application server cluster and a storage server cluster; Wherein, the Nginx proxy server cluster is used to send the request file data to the application server cluster; The application server cluster obtains corresponding data from the storage server cluster according to the content of the requested file data, and returns the obtained data to the Nginx proxy server cluster to be transmitted to the first proxy server based on the isolation and exchange control module.

5. The inter-network data transmission system according to claim 4, characterized in that: The Nginx proxy server cluster includes multiple Nginx proxy servers, multiple application servers are arranged on each Nginx proxy server, the same weight is configured for each application server, and the Nginx proxy server distributes requests in a polling manner.

6. The inter-network data transmission system according to claim 1, characterized in that: Verify the identity of the user system attempting to access resources, including: Acquire access request data, wherein the access request data represents request data for a user system to access a resource; Extracting the access request data based on the user system identity to obtain request identity data; The requested identity identification data is matched with a preset network gate access server database to realize data connection between the user system and the data transmission network gate, wherein, if the preset network gate access server database contains access server data matching the requested identity identification data, the user system is connected to the data transmission network gate; if the preset network gate access server database does not contain access server data matching the requested identity identification data, the user system is not connected to the data transmission network gate.

7. The inter-network data transmission system according to claim 1, characterized in that: Performing data stripping on the request file data transmitted by the proxy server and storing the stripped data in the data buffer includes: Performing application protocol-based elimination processing on the request file data transmitted by the proxy server to obtain gatekeeper transmission data, wherein the gatekeeper transmission data is used to represent the request file data after the proxy server application protocol is eliminated; The gateway transmission data is encapsulated in a private protocol, wherein the private protocol is a protocol preset by the data transmission gateway.

8. A data transmission network gate, characterized in that: include: A first intranet processing module, an isolation and switching control module, and a second intranet processing module; The first intranet processing module is used to connect to the first proxy server, confirm the identity of the user system attempting to access the resource, and prevent the user system from directly connecting to the first proxy server through the network; perform data stripping processing on the request file data transmitted by the first proxy server, and store the stripped data in the first intranet data buffer; The second intranet processing module is used to connect to the second proxy server, confirm the identity of the user system that attempts to access the resource, and prevent the user system from directly connecting to the second proxy server through the network; Performing data stripping processing on the request file data transmitted by the second proxy server, and storing the stripped data in the second intranet data buffer; Two ends of the isolation and exchange control module are respectively connected to the first intranet processing module and the second intranet processing module, and are used to control the data exchange between the first intranet data buffer and the second intranet data buffer; The first proxy server is located in a first local area network, and the second proxy server is located in a second local area network.

9. A cross-network data transmission method, characterized in that: include: The first proxy server receives a service data request sent by a user system, generates exchangeable request file data based on the service data request, and sends the request file data to the data transmission network gate; wherein the first proxy server is located in the first local area network; The data transmission network gatekeeper confirms the identity of the user system attempting to access the resource, and blocks the direct network connection with the user system of the first proxy server; The data transmission network gate performs data stripping processing on the request file data transmitted by the first proxy server, and sends the stripped data to the second proxy server; wherein the second proxy server is located in the second local area network.

10. The cross-network data transmission method according to claim 9, characterized in that: The data transmission network gate performs data stripping processing on the request file data transmitted by the first proxy server, and sends the stripped data to the second proxy server, comprising: The first intranet processing module confirms the identity of the user system attempting to access the resource, and blocks the direct network connection with the user system of the first proxy server; performs data stripping processing on the request file data transmitted by the first proxy server, and stores the stripped data in the first intranet data buffer; The isolation and exchange control module obtains the data in the first intranet data buffer, encapsulates the data and sends it to the second intranet processing module; The second intranet processing module obtains the data transmitted by the isolation and exchange control module, and sends the data to the second proxy server through the intranet interface.

Images