Network data remote transmission method and device based on single-guide module

Abstract

The invention discloses a network data remote transmission method and device based on a single guide module, and the method comprises the steps: transmitting target data to the single guide module through a user network end according to a demand; the single guide module carries out encryption processing on the received target data, and transmits the encrypted target data to an IPSec security gateway; and the IPSec security gateway carries out security processing on the received target data and transmits the processed target data to a server. According to the invention, in a cross-confidential information system scene, the data transmission security between confidential information systems can be improved, and the security impact of newly added wired / wireless access points on the confidential information systems can be avoided at the same time.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network communication, and in particular to a method and device for remote transmission of network data based on a single-lead module. Background Art

[0002] One-way transmission mode, also known as one-way transmission mode or one-way transmission function, is mainly used to transmit data from a low-density area to a high-density area, ensuring that data can only be sent from one device to another and not in the opposite direction. This mode is common in certain communication protocols and network connections, such as serial communication, where one device is responsible for sending data and the other is responsible for receiving data. One-way transmission can provide a certain degree of security because there is only one direction of transmission, thereby reducing potential security risks.

[0003] The existing one-way transmission equipment types are mainly divided into the following two categories:

[0004] Desktop one-way import device: This device uses optical one-way transmission technology to achieve one-way data transmission while ensuring the security of sensitive data in high-density areas. It is especially suitable for data transmission between network environments with different security levels. This device usually uses external storage media such as USB flash drives to import data into high-density areas one-way, and does not support long-distance data transmission;

[0005] One-way network gate device: isolated ferry technology, this technology simulates artificial data "copying" and realizes directional "ferrying" of data without establishing two network "physical paths". One-way network gate devices provide remote data transmission function, but will not provide confidentiality and integrity protection for business data during transmission.

[0006] Therefore, how to invent a network data remote transmission method based on a single-guide module that can improve the security of data transmission between confidential information systems in cross-confidential information system scenarios while avoiding the security impact of newly added wired / wireless access points on confidential information systems has become an urgent problem to be solved. Summary of the invention

[0007] To this end, the present invention provides a network data remote transmission method and device based on a single-guide module. The method can improve the data transmission security between confidential information systems in a cross-confidential information system scenario, while avoiding the security impact of newly added wired / wireless access points on confidential information systems.

[0008] In order to achieve the above object, the present invention provides the following technical solution: a network data remote transmission method based on a single-lead module, comprising:

[0009] The user network end transmits the target data to the single-guide module according to the requirements;

[0010] The single-guide module encrypts the received target data and transmits the encrypted target data to the IPSec security gateway;

[0011] The IPSec security gateway securely processes the received target data and transmits the processed target data to the server;

[0012] The single-guide module includes an internal main control chip, an external main control chip, an algorithm module and a single-guide module; the internal main control chip provides a communication and authentication interface for the internal network to configure and manage the single-guide module; the external main control chip provides a wired / wireless communication interface to receive the configuration of the internal main control chip, provide certificate key management and IPSEC secure communication; the algorithm module provides algorithm operations for the external main control chip; the single-guide module performs photoelectric conversion on the signals between the internal main control chip and the external main control chip.

[0013] As a preferred solution of a network data remote transmission method based on a single-conductor module, the single-conductor module also includes a radio frequency module; a connection is established between the internal main control chip and the external main control chip, and connections are established between the algorithm module, the single-conductor module, and the radio frequency module and the external main control chip; the single-conductor module also establishes a connection with the internal main control chip.

[0014] As a preferred solution of a network data remote transmission method based on a single-guide module, in the single-guide module, the internal main control chip also provides a service proxy function for the internal network and terminates the external network connection of the internal network;

[0015] The unidirectional transmission module utilizes the unidirectional transmission property of light to realize unidirectional data communication between the internal main control chip and the external main control chip;

[0016] The radio frequency module is used for receiving and sending wireless data and transmitting data.

[0017] As a preferred solution for a method for remote transmission of network data based on a single-guide module, during the process of the single-guide module encrypting the received target data, the single-guide module terminates the network service connection between the internal network and the external network through a dual gateway architecture, shields the network attack of the external public network on the internal network equipment, and enables the target data to be transmitted securely.

[0018] As a preferred solution for a network data remote transmission method based on a single-conductor module, in the process of the single-conductor module encrypting the received target data, the single-conductor module in the single-conductor module uses an optical single-conductor strategy to "physically isolate" the confidential information system from the non-confidential information system, shielding the external network from attacks on the confidential information system, so that the target data can be transmitted securely.

[0019] The present invention also provides a network data remote transmission device based on a single-lead module, which adopts the above-mentioned network data remote transmission method based on a single-lead module, comprising:

[0020] The data sending unit is used for the user network end to transmit the target data to the single-lead module according to the requirements;

[0021] A single-guide module encryption processing unit, used for the single-guide module to encrypt the received target data and transmit the encrypted target data to the IPSec security gateway;

[0022] An IPSec security gateway processing unit, used for the IPSec security gateway to perform security processing on the received target data and transmit the processed target data to the server;

[0023] The single-guide module includes an internal main control chip, an external main control chip, an algorithm module and a single-guide module; the internal main control chip provides a communication and authentication interface for the internal network to configure and manage the single-guide module; the external main control chip provides a wired / wireless communication interface to receive the configuration of the internal main control chip, provide certificate key management and IPSEC secure communication; the algorithm module provides algorithm operations for the external main control chip; the single-guide module performs photoelectric conversion on the signals between the internal main control chip and the external main control chip.

[0024] As a preferred solution for a network data remote transmission device based on a single-guide module, in the single-guide module encryption processing unit, the single-guide module also includes a radio frequency module; a connection is established between the internal main control chip and the external main control chip, and connections are established between the algorithm module, the single-guide module, and the radio frequency module and the external main control chip; and the single-guide module also establishes a connection with the internal main control chip.

[0025] As a preferred solution of a network data remote transmission device based on a single-guide module, in the single-guide module encryption processing unit, the internal main control chip also provides a service proxy function for the internal network and terminates the external network connection of the internal network;

[0026] The unidirectional transmission module utilizes the unidirectional transmission property of light to realize unidirectional data communication between the internal main control chip and the external main control chip;

[0027] The radio frequency module is used for receiving and sending wireless data and transmitting data.

[0028] As a preferred solution for a network data remote transmission device based on a single-guide module, in the single-guide module encryption processing unit, while the single-guide module encrypts the received target data, the single-guide module terminates the network service connection between the internal network and the external network through a dual gateway architecture, shields the network attack of the external public network on the internal network equipment, and enables the target data to be transmitted securely.

[0029] As a preferred solution for a network data remote transmission device based on a single-conductor module, in the single-conductor module encryption processing unit, during the process of the single-conductor module encrypting the received target data, the single-conductor module in the single-conductor module utilizes an optical single-conductor strategy to "physically isolate" the confidential information system from the non-confidential information system, shielding the external network from attacks on the confidential information system, and allowing the target data to be transmitted securely.

[0030] The present invention has the following advantages: the user network terminal transmits the target data to the single-guide module according to the demand; the single-guide module encrypts the received target data and transmits the encrypted target data to the IPSec security gateway; the single-guide module includes an internal main control chip, an external main control chip, an algorithm module, a single-guide module and a radio frequency module. The internal main control chip is used to provide the communication and authentication interface of the internal network, configure and manage the single-guide module; provide the service proxy function for the internal network, and terminate the network connection of the internal network to the outside; the external main control chip is used to provide the wired / wireless communication interface to the outside, receive the configuration of the internal main control chip, provide certificate key management and IPSEC secure communication; the algorithm module is used to provide algorithm operation for the external main control chip; the single-guide module is used to perform photoelectric conversion on the signal between the internal main control chip and the external main control chip, and use the unidirectional conductivity of light to realize the one-way data communication between the internal main control chip and the external main control chip; the radio frequency module is used for wireless data transmission and data transmission. In the process of the single-guide module encrypting the received target data, the single-guide module terminates the network service connection of the internal network and the external network through the dual gateway architecture, shields the network attack of the external public network on the internal network device, and enables the target data to be transmitted safely. The single-guide module in the single-guide module uses the optical single-guide strategy to "physically isolate" the confidential information system from the non-confidential information system, shields the attack of the external network on the confidential information system, and enables the target data to be transmitted safely. The IPSec security gateway performs safe processing on the received target data and transmits the processed target data to the server. The single-guide module proposed by the present invention uses the Linux firewall to manage the service addresses and ports opened by the internal and external dual gateways, which can effectively defend against most network message attacks. The single-guide module uses the network proxy service to terminate the internal and external network connections, and logically isolates the connection service between the confidential information system and the public information system. The data obtained by the network proxy service is transmitted from the internal gateway to the external gateway through the dedicated data ferry protocol; the single-guide module is used between the dual gateways to physically isolate the confidential information system and the public information system, and avoid the network penetration of the public information system into the confidential information system. The present invention also utilizes IPSec VPN technology to transfer data between confidential information systems across public information systems, providing confidentiality and integrity protection for communication data. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the drawings required for the implementation methods or the prior art descriptions are briefly introduced below. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0032] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0033] Figure 1 A schematic flow chart of a method for remote transmission of network data based on a single-lead module provided in Example 1 of the present invention;

[0034] Figure 2 A schematic diagram of a specific logical framework of a method for remote transmission of network data based on a single-lead module provided in Example 1 of the present invention;

[0035] Figure 3 A schematic diagram of a logical composition framework of a single-lead module in a network data remote transmission method based on a single-lead module provided in Embodiment 1 of the present invention;

[0036] Figure 4 A schematic diagram of a data acquisition system framework in a network data remote transmission method based on a single-lead module provided in Example 1 of the present invention;

[0037] Figure 5 A schematic diagram of a logical processing flow of an HTTP service proxy in a possible embodiment provided in Embodiment 1 of the present invention;

[0038] Figure 6 A schematic diagram of the architecture of a network data remote transmission device based on a single-lead module provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0039] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0040] Example 1

[0041] See also Figure 1 and Figure 2 Embodiment 1 of the present invention provides a method for remotely transmitting network data based on a single-lead module, comprising:

[0042] S1. The user network terminal transmits the target data to the single-guide module according to the demand;

[0043] S2, the single guide module encrypts the received target data and transmits the encrypted target data to the IPSec security gateway;

[0044] S3. The IPSec security gateway securely processes the received target data and transmits the processed target data to the server.

[0045] In this embodiment, in step S1, the user network terminal transmits the target data to the single-guide module according to demand.

[0046] In this embodiment, in step S2, the single guide module encrypts the received target data and transmits the encrypted target data to the IPSec security gateway;

[0047] Specifically, Figure 3 As shown, the single-conductor module includes an internal main control chip, an external main control chip, an algorithm module, a single-conductor module and a radio frequency module; a connection is established between the internal main control chip and the external main control chip, and a connection is established between the algorithm module, the single-conductor module and the radio frequency module and the external main control chip; the single-conductor module also establishes a connection with the internal main control chip.

[0048] The internal main control chip is used to provide the communication and authentication interface of the internal network, configure and manage the single-lead module, provide a service proxy function for the internal network, and terminate the external network connection of the internal network;

[0049] The external main control chip is used to provide a wired / wireless communication interface to the outside, receive the configuration of the internal main control chip, and provide certificate key management and IPSEC secure communication;

[0050] The algorithm module is used to provide algorithm operation for the external main control chip;

[0051] The single-conductance module is used to perform photoelectric conversion on the signal between the internal main control chip and the external main control chip, and realize the one-way data communication between the internal main control chip and the external main control chip by using the unidirectional conductivity of light;

[0052] The radio frequency module is used for receiving and sending wireless data and transmitting data.

[0053] In this embodiment, during the encryption process of the received target data by the single-guide module, the single-guide module terminates the network service connection of the internal network and the external network through the dual gateway architecture, shields the network attack of the external public network on the internal network equipment, and enables the target data to be transmitted safely. At the same time, the single-guide module in the single-guide module uses the optical single-guide strategy to "physically isolate" the confidential information system from the non-confidential information system, shield the attack of the external network on the confidential information system, and enable the target data to be transmitted safely.

[0054] In this embodiment, in step S3, the IPSec security gateway performs security processing on the received target data, and transmits the processed target data to the server.

[0055] Among them, through IPSec security gateway technology, wireless / wired encrypted data transmission can be achieved, ensuring the confidentiality and integrity of process data across non-confidential information systems.

[0056] The present invention can be widely used in data acquisition systems, such as monitoring systems in the fields of meteorology, water conservancy, electricity, etc. Figure 4 As shown in the figure, the central computer room deploys an IPSec security gateway to protect the network security of the monitoring server while protecting the confidentiality and integrity of the monitoring data transmitted by the monitoring point;

[0057] The present invention provides a data single-guide module with encryption and authentication functions, which can transmit monitoring data to the central computer room server via wired / wireless methods. In addition to providing a secure wired / wireless communication method for the internal network / terminal equipment, the single-guide module provides a security protection barrier through logical and physical isolation technology.

[0058] In a possible embodiment, an HTTP service proxy example is provided as follows:

[0059] HTTP service proxy logic processing flow diagram, such as Figure 5 The specific processing flow is as follows:

[0060] T1. The default state of the device is to block all messages from the internal and external networks. This function is implemented by the iptables component in the Linux firewall system NetFilter, and takes effect by issuing the "iptables-P INPUT DROP" command from the application layer;

[0061] T2. The user configures the basic network information of the internal gateway and the network proxy service port. After the configuration is issued, the internal gateway synchronously develops the HTTP service port through the command "iptables-AINPUT-p tcp--dport 80-j ACCEPT", and the HTTP proxy service is started at the same time to open the service channel for the internal network devices;

[0062] T3. The user configures the basic network information of the external gateway and the network proxy service address, port, and secure tunnel information. After the configuration is issued, the external gateway opens the IKE protocol and ESP protocol messages through the commands "iptables-A INPUT-p udp--dport 500-j ACCEPT", "iptables-AINPUT-p udp--dport 4500-j ACCEPT", and "iptables-AINPUT-p esp-jACCEPT" to ensure that key negotiation and security protocols can communicate normally. At the same time, the HTTP proxy client is started, ready to securely transmit intranet data to the server;

[0063] T4. The RF module provides AT instruction set, including general command instruction set, SIM card related command instruction set, network service command instruction set, status control command instruction set, etc. The external gateway uses the AT instruction set through UART to realize control instruction communication with the RF module, such as SIM card status (whether inserted), SIM card IMSI information query, network signal strength, dial-up Internet access, etc. The network dial-up operation is completed through AT instructions to realize wireless communication function;

[0064] T5. The device starts up normally. The external gateway actively initiates negotiation with the peer IPSec security gateway based on the configured security tunnel information. It securely establishes and updates the encryption, decryption and authentication keys of the security tunnel through IKE (Internet Key Exchange Protocol), and establishes a secure channel for data transmission. The data in the secure channel uses the AH / ESP security protocol to provide confidentiality and integrity protection for data in cross-domain public network systems. The algorithm module participates in the algorithm operations for confidentiality and integrity. The algorithm module supports asymmetric algorithms: RSA1024 / 2048, SM2; symmetric algorithms: ECB / CBC mode of DES / 3DES, ECB / CBC / CFB / OFB mode of AES, ECB / CBC / CFB / OFB mode of SM4; the digest algorithm supports SM3, SHA1 / SHA256;

[0065] T6. At this time, the device has entered the working state, and the internal gateway HTTP proxy service is waiting for the HTTP request data of the intranet device;

[0066] T7. The intranet device pushes the business data to the HTTP proxy service of the internal gateway through the HTTP protocol. After receiving the business data, the HTTP proxy service transparently transmits the business data to the data ferry service through the internal gateway IPC interface. Finally, the ferry protocol between the internal and external gateways pushes the business data to the external gateway. The ferry protocol contains the binding session information of the internal and external network HTTP proxy services, the ferry data and its length, the integrity check code of the ferry data, etc.

[0067] T8. After receiving the ferry protocol data, the external gateway performs an integrity check on the data. If the check succeeds, it is passed to the bound HTTP proxy client service through the IPC interface according to the session information in the ferry protocol. The HTTP proxy client pushes the data to the server through the HTTP protocol according to the configured remote server information (this process protects the confidentiality and integrity of the business data through a secure channel).

[0068] The above steps T6-T8 are a one-way transmission process for business data. In this process, the one-way transmission of data is realized between the internal gateway and the external gateway through a single-guide module; the external gateway feeds back control information to the internal gateway through UART, including the establishment status of the security channel, the verification failure information of the business data, the server connection status, the data transmission result, etc. The internal gateway responds to the HTTP request result of the intranet device according to the feedback control information.

[0069] In summary, the user network end of the present invention transmits the target data to the single-guide module according to the demand; the single-guide module encrypts the received target data and transmits the encrypted target data to the IPSec security gateway; the single-guide module includes an internal main control chip, an external main control chip, an algorithm module, a single-guide module and a radio frequency module. The internal main control chip is used to provide the communication and authentication interface of the internal network, configure and manage the single-guide module; provide service proxy function for the internal network, and terminate the network connection of the internal network to the outside; the external main control chip is used to provide a wired / wireless communication interface to the outside, receive the configuration of the internal main control chip, provide certificate key management and IPSEC secure communication; the algorithm module is used to provide algorithm operation for the external main control chip; the single-guide module is used to perform photoelectric conversion on the signal between the internal main control chip and the external main control chip, and use the unidirectional conductivity of light to realize the one-way data communication between the internal main control chip and the external main control chip; the radio frequency module is used for wireless data transmission and data transmission. In the process of the single-guide module encrypting the received target data, the single-guide module terminates the network service connection of the internal network and the external network through the dual gateway architecture, shields the network attack of the external public network on the internal network device, and enables the target data to be transmitted safely. The single-guide module in the single-guide module uses the optical single-guide strategy to "physically isolate" the confidential information system from the non-confidential information system, shields the attack of the external network on the confidential information system, and enables the target data to be transmitted safely. The IPSec security gateway performs safe processing on the received target data and transmits the processed target data to the server. The single-guide module proposed by the present invention uses the Linux firewall to manage the service addresses and ports opened by the internal and external dual gateways, which can effectively defend against most network message attacks. The single-guide module uses the network proxy service to terminate the internal and external network connections, and logically isolates the connection service between the confidential information system and the public information system. The data obtained by the network proxy service is transmitted from the internal gateway to the external gateway through the dedicated data ferry protocol; the single-guide module is used between the dual gateways to physically isolate the confidential information system and the public information system, and avoid the network penetration of the public information system into the confidential information system. The present invention also utilizes IPSec VPN technology to transfer data between confidential information systems across public information systems, providing confidentiality and integrity protection for communication data.

[0070] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0071] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0072] Example 2

[0073] See also Figure 6 Embodiment 2 of the present invention provides a network data remote transmission device based on a single-lead module, comprising:

[0074] The data sending unit 001 is used for the user network end to transmit the target data to the single guide module according to the demand;

[0075] The single-guide module encryption processing unit 002 is used for the single-guide module to encrypt the received target data and transmit the encrypted target data to the IPSec security gateway;

[0076] The IPSec security gateway processing unit 003 is used for the IPSec security gateway to perform security processing on the received target data and transmit the processed target data to the server.

[0077] In this embodiment, in the single-conductor module encryption processing unit 002, the single-conductor module includes an internal main control chip, an external main control chip, an algorithm module, a single-conductor module and a radio frequency module; a connection is established between the internal main control chip and the external main control chip, and a connection is established between the algorithm module, the single-conductor module, and the radio frequency module and the external main control chip; the single-conductor module also establishes a connection with the internal main control chip.

[0078] In this embodiment, in the single-guide module encryption processing unit 002, in the single-guide module, the internal main control chip is used to provide a communication and authentication interface for the internal network, configure and manage the single-guide module; provide a service proxy function for the internal network, and terminate the external network connection of the internal network;

[0079] The external main control chip is used to provide a wired / wireless communication interface to the outside, receive the configuration of the internal main control chip, and provide certificate key management and IPSEC secure communication;

[0080] The algorithm module is used to provide algorithm operation for the external main control chip;

[0081] The single-conductance module is used to perform photoelectric conversion on the signal between the internal main control chip and the external main control chip, and realize the one-way data communication between the internal main control chip and the external main control chip by using the unidirectional conductivity of light;

[0082] The radio frequency module is used for receiving and sending wireless data and transmitting data.

[0083] In this embodiment, in the single-guide module encryption processing unit 002, when the single-guide module encrypts the received target data, the single-guide module terminates the network service connection between the internal network and the external network through the dual gateway architecture, shields the network attack of the external public network on the internal network equipment, and enables the target data to be transmitted securely.

[0084] In this embodiment, in the single-guide module encryption processing unit 002, when the single-guide module performs encryption processing on the received target data, the single-guide module in the single-guide module uses the optical single-guide strategy to "physically isolate" the confidential information system from the non-confidential information system, shield the external network from attacks on the confidential information system, and enable the target data to be transmitted securely.

[0085] It should be noted that the information interaction, execution process, etc. between the modules / units of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown in the previous part of the present application, and will not be repeated here.

[0086] Example 3

[0087] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a network data remote transmission method based on a single-guide module is stored. The program code includes instructions for executing embodiment 1 or any possible implementation method of a network data remote transmission method based on a single-guide module.

[0088] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0089] Example 4

[0090] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0091] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a network data remote transmission method based on a single-guide module in Example 1 or any possible implementation thereof.

[0092] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0093] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0094] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, and optionally, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0095] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A network data remote transmission method based on a single-lead module, characterized in that: include: The user network end transmits the target data to the single-guide module according to the requirements; The single-guide module encrypts the received target data and transmits the encrypted target data to the IPSec security gateway; The IPSec security gateway securely processes the received target data and transmits the processed target data to the server; The single-guide module includes an internal main control chip, an external main control chip, an algorithm module and a single-guide module; the internal main control chip provides a communication and authentication interface for the internal network to configure and manage the single-guide module; the external main control chip provides a wired / wireless communication interface to receive the configuration of the internal main control chip, provide certificate key management and IPSEC secure communication; the algorithm module provides algorithm operations for the external main control chip; the single-guide module performs photoelectric conversion on the signals between the internal main control chip and the external main control chip.

2. According to claim 1, a method for remote transmission of network data based on a single-lead module is characterized in that: The single-conductor module also includes a radio frequency module; a connection is established between the internal main control chip and the external main control chip, and connections are established between the algorithm module, the single-conductor module, and the radio frequency module and the external main control chip; the single-conductor module also establishes a connection with the internal main control chip.

3. A method for remote transmission of network data based on a single-lead module according to claim 2, characterized in that: In the single-lead module, the internal main control chip also provides a service proxy function for the internal network and terminates the external network connection of the internal network; The unidirectional transmission module utilizes the unidirectional transmission property of light to realize unidirectional data communication between the internal main control chip and the external main control chip; The radio frequency module is used for receiving and sending wireless data and transmitting data.

4. A method for remote transmission of network data based on a single-lead module according to claim 3, characterized in that: During the process of the single-guide module encrypting the received target data, the single-guide module terminates the network service connection between the internal network and the external network through the dual gateway architecture, shields the network attack of the external public network on the internal network equipment, and enables the target data to be transmitted securely.

5. A method for remote transmission of network data based on a single-lead module according to claim 4, characterized in that: During the process of the single-conductor module encrypting the received target data, the single-conductor module in the single-conductor module utilizes the optical single-conductor strategy to "physically isolate" the confidential information system from the non-confidential information system, shielding the external network from attacks on the confidential information system, and allowing the target data to be transmitted securely.

6. A network data remote transmission device based on a single-lead module, using a network data remote transmission method based on a single-lead module as claimed in any one of claims 1 to 5, characterized in that: include: The data sending unit is used for the user network end to transmit the target data to the single-lead module according to the requirements; A single-guide module encryption processing unit, used for the single-guide module to encrypt the received target data and transmit the encrypted target data to the IPSec security gateway; An IPSec security gateway processing unit, used for the IPSec security gateway to perform security processing on the received target data and transmit the processed target data to the server; The single-guide module includes an internal main control chip, an external main control chip, an algorithm module and a single-guide module; the internal main control chip provides a communication and authentication interface for the internal network to configure and manage the single-guide module; the external main control chip provides a wired / wireless communication interface to receive the configuration of the internal main control chip, provide certificate key management and IPSEC secure communication; the algorithm module provides algorithm operations for the external main control chip; the single-guide module performs photoelectric conversion on the signals between the internal main control chip and the external main control chip.

7. A network data remote transmission device based on a single-lead module according to claim 6, characterized in that: In the single-conductor module encryption processing unit, the single-conductor module also includes a radio frequency module; a connection is established between the internal main control chip and the external main control chip, and a connection is established between the algorithm module, the single-conductor module, and the radio frequency module and the external main control chip; the single-conductor module also establishes a connection with the internal main control chip.

8. A network data remote transmission device based on a single-lead module according to claim 7, characterized in that: In the single-module encryption processing unit, the internal main control chip also provides a service proxy function for the internal network and terminates the external network connection of the internal network; The unidirectional transmission module utilizes the unidirectional transmission property of light to realize unidirectional data communication between the internal main control chip and the external main control chip; The radio frequency module is used for receiving and sending wireless data and transmitting data.

9. A network data remote transmission device based on a single-lead module according to claim 8, characterized in that: In the single-guide module encryption processing unit, during the process of the single-guide module encrypting the received target data, the single-guide module terminates the network service connection between the internal network and the external network through the dual gateway architecture, shields the network attack of the external public network on the internal network equipment, and enables the target data to be transmitted securely.

10. A network data remote transmission device based on a single-lead module according to claim 9, characterized in that: In the single-conductor module encryption processing unit, during the process of the single-conductor module encrypting the received target data, the single-conductor module in the single-conductor module uses the optical single-conductor strategy to "physically isolate" the confidential information system from the non-confidential information system, shielding the external network from attacks on the confidential information system, so that the target data can be transmitted securely.

Images