Network security one-way isolation system and method of communication satellite system and electronic equipment

Abstract

The invention provides a network security one-way isolation system and method of a communication satellite system and electronic equipment, and relates to the technical field of communication, the network security one-way isolation system of the communication satellite system comprises a first one-way firewall, an intranet host system, a one-way gatekeeper, an extranet host system and a second one-way firewall, the intranet host system receives service data transmitted by the communication service network through the first one-way firewall, and performs format conversion processing on the service data to obtain internal interface data in a preset format supported by the one-way gatekeeper, so as to send the internal interface data in the preset format to the one-way gatekeeper, and the one-way gatekeeper forwards the data to the extranet host system; and the external network host system recovers the internal interface data in the preset format into service data, and sends the recovered service data to the external network through the second one-way firewall. According to the system, a multi-stage deep security protection framework of a two-stage firewall and a one-stage one-way gatekeeper is adopted, so that the network security of a communication service network is ensured.

Description

Technical Field

[0001] The present invention relates to the technical field of communications, and in particular to a network security one-way isolation system, method and electronic equipment for a communication satellite system. Background Art

[0002] The communication satellite system is an important space-based equipment, and it is very important to maintain the network security of the communication service network in the communication satellite system. In the existing technology, the communication between user centers of different levels is two-way, which is not very secure and poses a great threat to the security of the communication service network. Therefore, how to improve the security of cross-network interaction in the communication satellite system is a technical problem that needs to be solved urgently. Summary of the invention

[0003] The purpose of the present invention is to provide a network security unidirectional isolation system, method and electronic equipment for a communication satellite system, so as to realize secure unidirectional transmission between networks of different levels and ensure the network security of the communication service network.

[0004] In a first aspect, the present invention provides a network security unidirectional isolation system for a communication satellite system, comprising: a first unidirectional firewall, an intranet host system, a unidirectional network gateway, an extranet host system and a second unidirectional firewall; the intranet host system accesses the communication service network of the communication satellite system through the first unidirectional firewall, and the extranet host system accesses the external network through the second unidirectional firewall; the intranet host system and the extranet host system are only communicated through the unidirectional network gateway; the intranet host system is used to receive service data transmitted by the communication service network through the first unidirectional firewall, and perform format conversion processing on the service data to obtain internal interface data in a preset format supported by the unidirectional network gateway, so as to send the internal interface data in the preset format to the unidirectional network gateway; the unidirectional network gateway is used to receive the internal interface data in the preset format and forward it to the extranet host system; the extranet host system is used to restore the internal interface data in the preset format to service data, and send the restored service data to the external network through the second unidirectional firewall.

[0005] In an optional implementation, the intranet host system includes: a first switch, a first cross-network interactive proxy server cluster, a second switch and a first monitoring terminal; the first switch is connected to the first unidirectional firewall, and the second switch is connected to the inner business port of the unidirectional network gatekeeper; the first network cards of all servers in the first cross-network interactive proxy server cluster are connected to the first switch, and the second network cards of all servers in the first cross-network interactive proxy server cluster are connected to the second switch; the first monitoring terminal is respectively connected to the first switch and the second switch to support human-computer interaction; the first switch is used to receive business data sent by the first unidirectional firewall, and send it to the first cross-network interactive proxy server cluster; the first cross-network interactive proxy server cluster is used to perform format conversion processing on the business data, obtain internal interface data in a preset format supported by the unidirectional network gatekeeper, and send it to the unidirectional network gatekeeper through the second switch.

[0006] In an optional implementation, the external network host system includes: a third switch, a second cross-network interactive proxy server cluster, a fourth switch and a second monitoring terminal; the third switch is connected to the external service port of the unidirectional network gate, and the fourth switch is connected to the second unidirectional firewall; the first network cards of all servers in the second cross-network interactive proxy server cluster are connected to the third switch, and the second network cards of all servers in the second cross-network interactive proxy server cluster are connected to the fourth switch; the second monitoring terminal is respectively connected to the third switch and the fourth switch to support human-computer interaction; the third switch is used to receive internal interface data in a preset format sent by the unidirectional network gate, and send it to the second cross-network interactive proxy server cluster; the second cross-network interactive proxy server cluster is used to perform format recovery processing on the internal interface data in a preset format, obtain restored service data, and send it to the fourth switch; the fourth switch is used to send the restored service data to the external network through the second unidirectional firewall.

[0007] In an optional embodiment, the network security unidirectional isolation system also includes: an intranet management switch and an extranet management switch; the intranet management switch is respectively connected to the first unidirectional firewall, the equipment on the data transmission link in the intranet host system and the inner business port of the unidirectional network gate, and all are deployed with equipment status monitoring software; the extranet management switch is respectively connected to the outer business port of the unidirectional network gate, the equipment on the data transmission link in the extranet host system and the second unidirectional firewall, and all are deployed with equipment status monitoring software; the intranet management switch is used to monitor the equipment status of all hardware devices connected to it, and send the obtained equipment status information to the first server through the first management network; the extranet management switch is used to monitor the equipment status of all hardware devices connected to it, and send the obtained equipment status information to the second server through the second management network.

[0008] In an optional implementation, the network security unidirectional isolation system further includes: a network security audit system; the network security audit system is deployed in parallel on a fourth switch in the external network host system, and is used to audit the network behavior of the external network host system.

[0009] In an optional implementation, both the intranet host system and the extranet host system deploy anti-virus strategies and host management and control systems.

[0010] In an optional implementation, a cross-network interaction proxy software is deployed in a network security one-way isolation system; the cross-network interaction proxy software includes: a telegram protocol transceiver module, a file protocol transceiver module, a data transceiver monitoring module and a status management module; the telegram protocol transceiver module and the file protocol transceiver module are deployed in the first cross-network interaction proxy server cluster and the second cross-network interaction proxy server cluster; the data transceiver monitoring module and the status management module are deployed in the first monitoring terminal and the second monitoring terminal; the telegram protocol transceiver module is used to support the transmission of telegram data; the file protocol transceiver module is used to support the transmission of file data; the data transceiver monitoring module is used to monitor the data transceiver status of the telegram protocol transceiver module and the file protocol transceiver module, and provide a human-computer interaction interface; the status management module is used to display the duplex status and software running status of the cross-network interaction proxy server.

[0011] In a second aspect, the present invention provides a network security unidirectional isolation method for a communication satellite system, which is applied to the network security unidirectional isolation system of the communication satellite system of any one of the aforementioned embodiments, including: receiving business data transmitted by the communication business network through a first unidirectional firewall, and performing format conversion processing on the business data to obtain internal interface data in a preset format supported by the unidirectional network gate; sending the internal interface data in the preset format to the unidirectional network gate, so that the unidirectional network gate forwards it to an external network host system; wherein the external network host system is used to restore the internal interface data in the preset format to business data, and send the restored business data to the external network through a second unidirectional firewall.

[0012] In a third aspect, the present invention provides an electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, and when the processor executes the computer program, the steps of the network security unidirectional isolation method of the communication satellite system described in the aforementioned embodiment are implemented.

[0013] In a fourth aspect, the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the network security unidirectional isolation method of the communication satellite system described in the aforementioned embodiment is implemented.

[0014] The network security unidirectional isolation system of the communication satellite system provided by the present invention comprises: a first unidirectional firewall, an intranet host system, a unidirectional network gateway, an extranet host system and a second unidirectional firewall. The system adopts a multi-level in-depth security protection architecture of a 2-level firewall and a 1-level unidirectional network gateway, performs unidirectional forwarding control on the communication service network business data of the communication satellite system, realizes secure unidirectional transmission between networks of different levels, and ensures the network security of the communication service network. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0016] Figure 1 A structural block diagram of a network security one-way isolation system for a communication satellite system provided by an embodiment of the present invention;

[0017] Figure 2 A schematic diagram of an optional system composition of a one-way network security isolation system for a communication satellite system;

[0018] Figure 3 A schematic diagram of the functional composition of a cross-network interactive proxy software provided by an embodiment of the present invention;

[0019] Figure 4 A software architecture diagram of a cross-network interactive proxy software provided by an embodiment of the present invention;

[0020] Figure 5 A schematic diagram of the deployment of an optional cross-network interactive proxy server;

[0021] Figure 6 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0022] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings here can be arranged and designed in various different configurations.

[0023] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention claimed for protection, but merely represents selected embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0024] Some embodiments of the present invention are described in detail below in conjunction with the accompanying drawings. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0025] Embodiment 1

[0026] Figure 1 A structural block diagram of a network security one-way isolation system for a communication satellite system provided by an embodiment of the present invention, such as Figure 1 As shown, the network security unidirectional isolation system includes: a first unidirectional firewall 10, an intranet host system 20, a unidirectional network gate 30, an extranet host system 40 and a second unidirectional firewall 50.

[0027] The intranet host system accesses the communication service network of the communication satellite system through the first unidirectional firewall, and the extranet host system accesses the external network through the second unidirectional firewall.

[0028] The intranet host system and the extranet host system are connected for communication only through a one-way gateway.

[0029] The intranet host system is used to receive business data transmitted by the communication business network through the first unidirectional firewall, and perform format conversion on the business data to obtain internal interface data in a preset format supported by the unidirectional firewall, so as to send the internal interface data in the preset format to the unidirectional firewall.

[0030] The one-way gateway is used to receive internal interface data in a preset format and forward it to the external host system.

[0031] The external network host system is used to restore the internal interface data in a preset format into business data, and send the restored business data to the external network through the second unidirectional firewall.

[0032] Specifically, the network security unidirectional isolation system in the embodiment of the present invention can be regarded as a security isolation zone of a communication satellite system. Based on the above introduction to its composition structure, it can be seen that the security isolation zone adopts a multi-level in-depth security protection architecture of two-level unidirectional firewalls (first unidirectional firewall and second unidirectional firewall) and a level 1 unidirectional network gate. The basic design concept of this architecture is to cut off the direct connection between the communication service network and the external network, while combining physical layer disconnection technology, link layer disconnection technology, TCP / IP protocol stripping and reconstruction technology, and application protocol stripping and reconstruction technology to achieve secure and reliable one-way transmission of data between networks with different security levels.

[0033] Optionally, the intranet host system, the extranet host system and the one-way network gate all use a high-performance network data processing platform and a dedicated customized system to prevent external hackers from attacking the device itself through the network and improve the security of the device itself. Optionally, the one-way network gate is implemented through an optical fiber isolation card, and its main function is to realize the one-way isolated transmission of telegrams and files from the communication business network to the external network based on the hardware isolation channel and the proprietary protocol.

[0034] The intranet host system and the extranet host system are two independent systems. There is no direct or indirect connection between the two systems except for the one-way firewall. The intranet host system is responsible for receiving the business data of the communication business network, converting its format and sending it to the outside through the one-way firewall. The purpose of the format conversion is to adjust the internal interface data to the preset format supported by the one-way firewall; the extranet host system is responsible for receiving the data forwarded by the one-way firewall, restoring it to the business data of the communication business system, and then sending it to the external network through the second one-way firewall.

[0035] It is known that the first unidirectional firewall is connected to the communication service network of the communication satellite system, and the second unidirectional firewall is connected to the external network. Therefore, the interface switch of the communication service network and the network security unidirectional isolation system is connected to the first unidirectional firewall, and in order to ensure the security of the network security unidirectional isolation system, the second unidirectional firewall can also be connected to the networking router of the external network through a cryptographic machine. Optionally, the first unidirectional firewall and the second unidirectional firewall can be set up in a manner similar to the master and backup machines, that is, the master and backup machines can be set up at the positions of each unidirectional firewall in the system to further ensure the stability of the system. Furthermore, two interfaces (master and backup interfaces) are set between the unidirectional firewall and the switch for communication connection.

[0036] The network security unidirectional isolation system of the communication satellite system provided by the embodiment of the present invention includes: a first unidirectional firewall, an intranet host system, a unidirectional network gateway, an extranet host system and a second unidirectional firewall. The system adopts a multi-level in-depth security protection architecture of 2-level firewalls and 1-level unidirectional network gateway to perform unidirectional forwarding control on the communication service network business data of the communication satellite system, realize secure unidirectional transmission between networks of different levels, and ensure the network security of the communication service network.

[0037] In an optional implementation, the intranet host system includes: a first switch, a first cross-network interaction proxy server cluster, a second switch and a first monitoring terminal.

[0038] The first switch is connected to the first unidirectional firewall, and the second switch is connected to the inner service port of the unidirectional firewall.

[0039] The first network cards of all servers in the first cross-network interaction proxy server cluster are connected to the first switch, and the second network cards of all servers in the first cross-network interaction proxy server cluster are connected to the second switch.

[0040] The first monitoring terminal is connected to the first switch and the second switch respectively, and is used to support human-computer interaction.

[0041] The first switch is used to receive the business data sent by the first unidirectional firewall, and send it to the first cross-network interaction proxy server cluster.

[0042] The first cross-network interaction proxy server cluster is used to perform format conversion processing on the service data, obtain internal interface data in a preset format supported by the one-way network switch, and send the internal interface data to the one-way network switch through the second switch.

[0043] According to the above description, the first switch and the second switch are devices that enable the cross-network interactive proxy servers (hereinafter referred to as servers) in the first cross-network interactive proxy server cluster to access different broadcast domains. The servers in the first cross-network interactive proxy server cluster convert the format of the service data received from the first switch, and then send the processed data through the second switch. The first monitoring terminal can provide a human-computer interaction interface. After communicating with the first switch and the second switch, the first monitoring terminal can display the data receiving and sending status of each server in the first cross-network interactive proxy server cluster, and also supports users to send control commands to the server through the first monitoring terminal, such as link parameter control commands, data sending commands, etc.

[0044] In an optional implementation, the external network host system includes: a third switch, a second cross-network interaction proxy server cluster, a fourth switch and a second monitoring terminal.

[0045] The third switch is connected to the external service port of the unidirectional network gate, and the fourth switch is connected to the second unidirectional firewall.

[0046] The first network cards of all servers in the second cross-network interaction proxy server cluster are connected to the third switch, and the second network cards of all servers in the second cross-network interaction proxy server cluster are connected to the fourth switch.

[0047] The second monitoring terminal is connected to the third switch and the fourth switch respectively, and is used to support human-computer interaction.

[0048] The third switch is used to receive the internal interface data in a preset format sent by the one-way network switch, and send it to the second cross-network interaction proxy server cluster.

[0049] The second cross-network interaction proxy server cluster is used to perform format recovery processing on the internal interface data in a preset format, obtain the recovered service data, and send it to the fourth switch.

[0050] The fourth switch is used to send the restored business data to the external network through the second unidirectional firewall.

[0051] According to the above description, the third switch and the fourth switch are devices that enable the servers in the second cross-network interactive proxy server cluster to access different broadcast domains. The servers in the second cross-network interactive proxy server cluster perform format recovery (i.e., format conversion) on the internal interface data in a preset format received from the third switch, and then send the recovered data through the fourth switch. The function of the second monitoring terminal is similar to that of the first monitoring terminal, and can provide a human-computer interaction interface, display the data receiving and sending status of each server in the second cross-network interactive proxy server cluster, and also support users to send control commands to the server through the second monitoring terminal.

[0052] In an optional implementation, the network security unidirectional isolation system further includes: an intranet management switch and an extranet management switch;

[0053] The intranet management switch is respectively connected to the first unidirectional firewall, the equipment on the data transmission link in the intranet host system and the inner service port of the unidirectional network gate, and all are deployed with equipment status monitoring software.

[0054] The external network management switch is respectively connected to the external service port of the one-way network gate, the equipment on the data transmission link in the external network host system and the second one-way firewall, and all of them are deployed with equipment status monitoring software.

[0055] The intranet management switch is used to monitor the device status of all hardware devices connected thereto, and send the obtained device status information to the first server through the first management network.

[0056] The external network management switch is used to monitor the device status of all hardware devices connected thereto, and send the obtained device status information to the second server through the second management network.

[0057] In order to realize the equipment management in the network security one-way isolation system, management switches are respectively set in the inner area (the area between the one-way network gate and the communication service network) and the outer area (the area between the one-way network gate and the external network) of the system. The inner network management switch is connected to the firewall in the inner area, the equipment on the data transmission link in the inner network host system (server and the first and second switches) and the inner service port of the one-way network gate. The outer network management switch is connected to the firewall in the outer area, the equipment on the data transmission link in the outer network host system (server and the third and fourth switches) and the outer service port of the one-way network gate. In addition, the equipment status monitoring software needs to be deployed in all the above equipment so that the inner / external network management switch can monitor the equipment status of the equipment connected to it. Then, the inner network management switch and the external network management switch respectively send the acquired information to the corresponding server through the management network they are connected to. In order to ensure that the inner area and the outer area can only be connected through the one-way network gate for communication, the first management network and the second management network are two independent and disconnected networks.

[0058] Optionally, if the device of the network security one-way isolation system is not connected to the intranet management switch / extranet management switch, then in order to realize the management of the device, the device that is not connected to the intranet management switch / extranet management switch reports its device status information to the server of the corresponding area (inside area / outside area) through the business network.

[0059] In an optional implementation, the network security one-way isolation system also includes: a network security audit system.

[0060] The network security audit system is deployed in parallel on the fourth switch in the external network host system and is used to audit the network behavior of the external network host system.

[0061] Specifically, the network security audit system is deployed on the fourth switch in the outer area. The port on the switch is configured as a mirror port, which has a network audit function, can audit the security characteristics of network behavior, support the expansion and customization of legal task data, and support post-event backtracking and auditing of network behavior. Optionally, the management configuration can choose the WEBUI method. When deploying and implementing, it is necessary to modify the default management IP, add the default route, and add the configuration listening port.

[0062] In an optional implementation, both the intranet host system and the extranet host system deploy anti-virus strategies and host management and control systems.

[0063] In the embodiment of the present invention, the antivirus strategy is mainly composed of two parts: client software and management center. The client is an agent and security component deployed in the terminal, which is mainly used to monitor changes in the user system environment, accurately identify known threats, initially warn of unknown threats, capture and report, block and intercept various threats, eliminate and deal with completed threats, and can execute multiple disposal tasks issued by the management center. The management center is a service end, mainly for security management personnel, to perform unified security management of endpoint assets, centrally monitor and analyze endpoint security events, and formulate and issue relevant disposal task strategies. The management center adopts a B / S architecture, and administrators can access the management center using a browser.

[0064] The first monitoring terminal and the first cross-network interactive proxy server cluster in the inner area of ​​the network security one-way isolation system are distributed with anti-virus policies and upgrades by the management center server through the first management network, while the second monitoring terminal and the second cross-network interactive proxy server cluster in the outer area of ​​the network security one-way isolation system are deployed with stand-alone versions. There are two main ways to upgrade the anti-virus policies of the devices in the outer area: one is to download the upgrade package using the offline download tool on the original upgrade server, make an upgrade CD, and then use the CD to manually upgrade the device offline; the other is to download the upgrade package from the official website virus library and make an upgrade CD, and then manually upgrade offline.

[0065] The host management and control system consists of a server, a management and control platform, and a client agent. The administrator logs in to the host management and control system server management and control platform through a browser, formulates management and control strategies, and then sends the strategies to the client. The client executes the management and control strategies and reports logs to the server.

[0066] The host control system is deployed in the same way as the antivirus strategy. The first monitoring terminal and the first cross-network interactive proxy server cluster in the inner area use the first management network to uniformly issue control strategies and upgrades from the host control server, while the second monitoring terminal and the second cross-network interactive proxy server cluster in the outer area deploy a stand-alone version. The control strategy upgrade path for devices in the outer area is to use an offline download tool to download the upgrade package on the original host control server, create an upgrade CD, and then use the CD to perform a manual offline upgrade.

[0067] Figure 2The present invention is an optional system composition diagram of a network security unidirectional isolation system for a communication satellite system. In this design, the first unidirectional firewall 10 inside the network security unidirectional isolation system (i.e., the security isolation zone) is interconnected with the interface switch NS through two ports, and is interconnected with the 10 Gigabit switch 1 (i.e., the first switch 101) through two ports, so as to realize the unidirectional control and forwarding function of the service data in the communication service network. The number of servers included in the first cross-network interactive proxy server cluster 102 and the second cross-network interactive proxy server cluster 103 is the same, both of which are N servers. The A network cards of the inner N servers are connected to the 10 Gigabit switch 1, and the B network cards are connected to the 10 Gigabit switch 2 (i.e., the second switch 104). The embodiment of the present invention does not specifically limit the number of servers in the above two cross-network interactive proxy server clusters, and users can set it according to actual needs.

[0068] Two 10G unidirectional network gates 30 are set in the system to divide the security isolation area into an inner business port connected to the 10G switch 2, and an outer interface connected to the 10G switch 3 (i.e., the third switch 105). The A network card of the N servers on the outside is connected to the 10G switch 3, and the B network card is connected to the 10G switch 4 (i.e., the fourth switch 106). Two outer unidirectional firewalls (i.e., the second unidirectional firewall 50) are each interconnected with the 10G switch 4 through two ports. In addition, independent monitoring equipment (the first monitoring equipment 107 and the second monitoring equipment 108) and management switches (the internal network management switch 109 and the external network management switch 110) are set in both the inner area and the outer area. Please refer to the above for the equipment connection relationship, which will not be repeated here.

[0069] The network security audit system 111 is deployed in a bypass manner. After the audit system is connected to the mirror port of the 10 Gigabit switch 4, basic configurations such as IP and mirror port are performed on the audit system.

[0070] From the description above, it can be seen that various devices in the network security one-way isolation system are deployed with device status monitoring software. The purpose of deploying this software is to monitor the network and devices in the network security one-way isolation system in real time, and realize the daily management and task management functions such as the collection, aggregation, distribution, processing, storage and analysis of operation and management information. It provides the system with comprehensive and accurate operation management information, provides a graphical monitoring display interface and fault alarm, violation inspection, statistical analysis and other functions, and intuitively displays the device status in the system in multiple views such as situation overview view, topology view, computer room view, logical view, task view, panel view, etc. For the specified device, it can poll and view the device attribute values ​​​​in a fine-grained manner, and can set the attribute values ​​of the specified device as needed.

[0071] In addition, when the status of equipment in the system can be monitored, a log alarm function can also be set up in the system to centrally display and manage event logs and alarms generated by the system and equipment. Specifically, corresponding performance alarm thresholds and alarm response methods are configured for various preset alarm events, fault judgment is made according to the alarm threshold, and alarms are issued according to the alarm response method.

[0072] In an optional implementation, cross-network interaction proxy software is deployed in the network security one-way isolation system; Figure 3 As shown, the cross-network interaction agent software includes: a message protocol transceiver module 21, a file protocol transceiver module 22, a data transceiver monitoring module 23 and a status management module 24.

[0073] The message protocol transceiver module and the file protocol transceiver module are deployed in the first cross-network interaction proxy server cluster and the second cross-network interaction proxy server cluster.

[0074] The data transceiver monitoring module and the status management module are deployed in the first monitoring terminal and the second monitoring terminal.

[0075] The message protocol transceiver module is used to support the transmission of message data.

[0076] The file protocol transceiver module is used to support the transmission of file data.

[0077] The data transceiver monitoring module is used to monitor the data transceiver status of the telegram protocol transceiver module and the file protocol transceiver module, and provide a human-computer interaction interface.

[0078] The status management module is used to display the duplex status and software running status of the cross-network interactive proxy server.

[0079] Specifically, the cross-network interactive proxy software adopts a C / S structure, which is composed of a message protocol transceiver module, a file protocol transceiver module on the server side, and a data transceiver monitoring module and a status management module on the client side. The server side of the software is a first cross-network interactive proxy server cluster and a second cross-network interactive proxy server cluster, and the client side of the software is a first monitoring terminal and a second monitoring terminal.

[0080] Figure 4 A software architecture diagram of a cross-network interactive proxy software provided by an embodiment of the present invention, such as Figure 4 As shown, the software system architecture is divided into three layers, including an operating environment, a cross-network interactive agent software and users. The operating environment provides an operating platform for the cross-network interactive agent software, including a hardware environment and a software environment. The hardware environment includes: a cross-network interactive agent server, an operation monitoring terminal (including: a first monitoring terminal and a second monitoring terminal); the software environment includes: a Linux operating system, a platform soft duplex management software, a platform time service software and a device status monitoring software.

[0081] The main functions of the cross-network interactive agent software can be divided into the transport layer and the interface layer. The transport layer is responsible for data transmission, including the message protocol transceiver module and the file protocol transceiver module. These two modules provide background services and run on the server as resident processes; the interface layer is responsible for the human-computer interaction of the user, including the data transceiver monitoring module and the status management module.

[0082] Figure 5 A schematic diagram of an optional deployment of a cross-network interactive proxy server is shown in FIG. Figure 5 As shown, if the first cross-network interactive proxy server cluster and the second cross-network interactive proxy server cluster are both equipped with N cross-network interactive proxy servers, then among the N servers on the inner side of the one-way network firewall, two servers receive two-way gigabit high-speed data of a specific type in a duplex hot standby form, and the other two servers receive two-way gigabit high-speed data of a non-specific type in a duplex hot standby form, and the remaining servers can be operated in a cold backup mode, and the dual-machine hot standby servers receive and process data at the same time, but only the host sends data outward, and the standby machine does not send data. The active-standby switching depends on the underlying duplex software, and the current active-standby status is obtained through the duplex software library interface. The deployment of N cross-network interactive proxy servers outside the one-way network firewall is consistent with that inside.

[0083] In the embodiment of the present invention, the cross-network interaction agent software includes: a message protocol transceiver module, a file protocol transceiver module, a data transceiver monitoring module and a status management module. Among them, the message protocol transceiver module includes: a link management unit, an internal system data receiving unit, a data protocol conversion unit, a data collection processing unit and an external data sending unit.

[0084] Specifically, the link management unit is used to read the preset link configuration file, generate external data transmission and reception link parameter data, and send the above data to the internal system data receiving unit and the external data sending unit respectively; it is also used to receive and cache the data frame statistics submitted by the internal system data receiving unit and the external data sending unit, and regularly report the link transmission and reception status to the monitoring terminal; receive the link control command sent by the monitoring terminal, and modify the link configuration parameters at runtime. The internal system data receiving unit receives the link configuration data sent by the link management unit, uses the specified data transmission protocol, establishes a data receiving link with the internal business system, receives the data frame and performs a basic format check of the data frame, forwards the data frame to the data protocol conversion unit, and completes the data reception frame statistics at the same time. The data protocol conversion unit processes the data frame according to the interface data format definition, parses each data item in the data frame, generates internal interface data in a unified format, and distributes it to the outside through the one-way network gate. The data aggregation processing unit is used to receive the data that needs to be sent to the outside forwarded by the one-way network gate, and according to the interface data format definition, frames to generate real-time data frames to be sent to the outside, and sends them to the external data sending unit. The external data sending unit receives the link configuration data sent by the link management unit, uses the specified data transmission protocol to establish a data sending link with the external system, receives the data frame sent by the data aggregation processing unit, sends it outward, and completes the data sending frame statistics at the same time.

[0085] The file protocol receiving and sending module includes: a file receiving and sending management unit, a file receiving unit, a file data protocol conversion unit, a file data recovery unit and a file sending unit. Among them, the file receiving and sending management unit reads the preset link configuration file, generates the parameter data of the file receiving and sending link, and provides the file receiving unit and the file sending unit with the file data receiving and sending link configuration; receives the link control command sent by the monitoring terminal, modifies the link configuration parameters during operation; and regularly reports the file receiving and sending status to the monitoring terminal. The file receiving unit can support the file receiving of the specified protocol, waits for the file sending request of the other party at the specified service address, receives the data file according to the protocol interaction process, saves the data file to the local, and completes the file receiving statistics. The file data protocol conversion unit is used to read the local file, process the file data according to the internal protocol data format definition of the one-way network gate, generate the internal interface data in a unified format, and then distribute it to the outside through the network gate. The file data recovery unit is used to receive the file type data that needs to be sent to the outside forwarded by the one-way network gate, and restore it to the local file as the data source of the file sending unit. The file sending unit is responsible for establishing a connection with the other party, sending the file to the other party according to the protocol interaction process, and completing the file sending statistics.

[0086] The data transceiver monitoring module includes a message transceiver monitoring unit and a file transceiver monitoring unit. The message transceiver monitoring unit receives the real-time message transceiver status data sent by the message protocol transceiver module, displays it in the form of an image or a table, and provides an operation interface for modifying the control command of the external data transceiver link parameters. The file transceiver monitoring unit receives the file transceiver status data sent by the file protocol transceiver module, displays it in the form of an image or a table, and provides an operation interface for link parameter control commands and file sending commands.

[0087] The status management module is used to display the duplex status and software running status of the cross-network interactive proxy server, where the duplex status includes: server IP, host name and server active / standby status; the software running status includes: software name, startup time and running server IP.

[0088] Based on the above description of the architecture of the cross-network interactive proxy software, it can be seen that the network security one-way isolation system forwards the business data of the telegram type to the outside in the following process: receiving the business data sent by the data distribution software in the communication business system, and performing a basic format check on the data frame; the data protocol conversion unit parses the data frame according to the interface data format definition to generate internal interface data; the data collection and processing unit outside the one-way network firewall assembles the frame according to the interface data format definition to generate real-time data frames for external transmission; and the external data sending unit sends the data frame to the external network.

[0089] In summary, the network security unidirectional isolation system provided by the embodiment of the present invention adopts a multi-level in-depth protection architecture of a 2-level firewall and a 1-level unidirectional network gate, and further enhances security by using application layer protocol auditing and protocol conversion mechanisms. It realizes secure unidirectional transmission between networks of different levels and ensures the network security of the communication service network.

[0090] Embodiment 2

[0091] An embodiment of the present invention also provides a one-way network security isolation method for a communication satellite system. The method is applied to the one-way network security isolation system of the communication satellite system provided in the above-mentioned embodiment one. The following is a specific introduction to the one-way network security isolation method for the communication satellite system provided in the embodiment of the present invention.

[0092] The network security unidirectional isolation method of the communication satellite system provided by the embodiment of the present invention mainly includes the following contents:

[0093] The service data transmitted by the communication service network through the first unidirectional firewall is received, and the service data is format converted to obtain internal interface data in a preset format supported by the unidirectional firewall.

[0094] The internal interface data in a preset format is sent to the one-way firewall so that the one-way firewall forwards it to the external host system; wherein the external host system is used to restore the internal interface data in the preset format to business data, and send the restored business data to the external network through the second one-way firewall.

[0095] Embodiment 3

[0096] See also Figure 6 An embodiment of the present invention provides an electronic device, which includes: a processor 60, a memory 61, a bus 62 and a communication interface 63, wherein the processor 60, the communication interface 63 and the memory 61 are connected via the bus 62; the processor 60 is used to execute an executable module stored in the memory 61, such as a computer program.

[0097] The memory 61 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk memory. The communication connection between the system network element and at least one other network element is realized through at least one communication interface 63 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0098] The bus 62 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 6 Only one bidirectional arrow is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0099] Among them, the memory 61 is used to store programs, and the processor 60 executes the program after receiving the execution instruction. The method executed by the device defined by the process disclosed in any embodiment of the above-mentioned embodiment of the present invention can be applied to the processor 60 or implemented by the processor 60.

[0100] The processor 60 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 60. The above processor 60 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiments of the present invention can be directly embodied as a hardware decoding processor to be executed, or the hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 61, and the processor 60 reads the information in the memory 61 and completes the steps of the above method in combination with its hardware.

[0101] An embodiment of the present invention provides a computer program product of a network security one-way isolation system, method and electronic device for a communication satellite system, including a computer-readable storage medium storing a non-volatile program code executable by a processor. The instructions included in the program code can be used to execute the method described in the previous method embodiment. The specific implementation can be found in the method embodiment, which will not be repeated here.

[0102] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0103] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0104] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0105] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inside", "outside", etc. indicate positions or positional relationships based on the positions or positional relationships shown in the accompanying drawings, or the positions or positional relationships in which the product of the invention is usually placed when in use. They are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific position, be constructed and operated in a specific position, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description, and cannot be understood as indicating or implying relative importance.

[0106] In addition, the terms "horizontal", "vertical", "overhanging" and the like do not mean that the components are required to be absolutely horizontal or overhanging, but can be slightly tilted. For example, "horizontal" only means that its direction is more horizontal than "vertical", and does not mean that the structure must be completely horizontal, but can be slightly tilted.

[0107] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0108] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security one-way isolation system for a communication satellite system, characterized in that: include: The first one-way firewall, the intranet host system, the one-way network gate, the extranet host system and the second one-way firewall; The intranet host system accesses the communication service network of the communication satellite system through the first unidirectional firewall, and the extranet host system accesses the external network through the second unidirectional firewall; The intranet host system and the extranet host system are connected for communication only through the one-way network gatekeeper; The intranet host system is used to receive the service data transmitted by the communication service network through the first unidirectional firewall, and perform format conversion processing on the service data to obtain internal interface data in a preset format supported by the unidirectional firewall, so as to send the internal interface data in the preset format to the unidirectional firewall; The one-way network gate is used to receive the internal interface data in the preset format and forward it to the external network host system; The external network host system is used to restore the internal interface data in the preset format into business data, and send the restored business data to the external network through the second unidirectional firewall.

2. The network security one-way isolation system of the communication satellite system according to claim 1 is characterized in that: The intranet host system includes: a first switch, a first cross-network interaction proxy server cluster, a second switch and a first monitoring terminal; The first switch is connected to the first unidirectional firewall, and the second switch is connected to the inner service port of the unidirectional firewall; The first network cards of all servers in the first cross-network interaction proxy server cluster are connected to the first switch, and the second network cards of all servers in the first cross-network interaction proxy server cluster are connected to the second switch; The first monitoring terminal is connected to the first switch and the second switch respectively, and is used to support human-computer interaction; The first switch is used to receive the service data sent by the first unidirectional firewall, and send it to the first cross-network interaction proxy server cluster; The first cross-network interaction proxy server cluster is used to perform format conversion processing on the service data to obtain internal interface data in a preset format supported by the one-way network gatekeeper, and send the internal interface data to the one-way network gatekeeper through the second switch.

3. The network security one-way isolation system of the communication satellite system according to claim 2 is characterized in that: The external network host system includes: a third switch, a second cross-network interaction proxy server cluster, a fourth switch and a second monitoring terminal; The third switch is connected to the external service port of the unidirectional network gate, and the fourth switch is connected to the second unidirectional firewall; The first network cards of all servers in the second cross-network interaction proxy server cluster are connected to the third switch, and the second network cards of all servers in the second cross-network interaction proxy server cluster are connected to the fourth switch; The second monitoring terminal is connected to the third switch and the fourth switch respectively, and is used to support human-computer interaction; The third switch is used to receive the internal interface data in a preset format sent by the one-way network gatekeeper, and send it to the second cross-network interaction proxy server cluster; The second cross-network interaction proxy server cluster is used to perform format recovery processing on the internal interface data in the preset format, obtain the recovered service data, and send it to the fourth switch; The fourth switch is used to send the restored service data to the external network through the second unidirectional firewall.

4. The network security one-way isolation system of the communication satellite system according to claim 1, characterized in that: The network security unidirectional isolation system also includes: an intranet management switch and an extranet management switch; The intranet management switch is respectively connected to the first unidirectional firewall, the equipment on the data transmission link in the intranet host system and the inner service port of the unidirectional network gate, and all are deployed with equipment status monitoring software; The external network management switch is respectively connected to the external service port of the one-way network gate, the equipment on the data transmission link in the external network host system and the second one-way firewall, and the equipment status monitoring software is deployed on all of them; The intranet management switch is used to monitor the device status of all hardware devices connected thereto, and send the obtained device status information to the first server through the first management network; The external network management switch is used to monitor the device status of all hardware devices connected thereto, and send the obtained device status information to the second server through the second management network.

5. The network security one-way isolation system of the communication satellite system according to claim 3 is characterized in that: The network security one-way isolation system also includes: a network security audit system; The network security audit system is deployed in parallel on the fourth switch in the external network host system, and is used to audit the network behavior of the external network host system.

6. The network security one-way isolation system of the communication satellite system according to claim 1, characterized in that: Both the intranet host system and the extranet host system deploy anti-virus strategies and host management and control systems.

7. The network security one-way isolation system of the communication satellite system according to claim 3, characterized in that: The cross-network interaction proxy software is deployed in the network security one-way isolation system; the cross-network interaction proxy software includes: a message protocol transceiving module, a file protocol transceiving module, a data transceiving monitoring module and a status management module; The message protocol transceiver module and the file protocol transceiver module are deployed in the first cross-network interaction proxy server cluster and the second cross-network interaction proxy server cluster; The data transceiver monitoring module and the status management module are deployed in the first monitoring terminal and the second monitoring terminal; The telegram protocol transceiver module is used to support the transmission of telegram data; The file protocol transceiver module is used to support the transmission of file data; The data transceiving monitoring module is used to monitor the data transceiving status of the telegram protocol transceiving module and the file protocol transceiving module, and provide a human-computer interaction interface; The state management module is used to display the duplex state and software running state of the cross-network interactive proxy server.

8. A one-way network security isolation method for a communication satellite system, characterized in that: A one-way network security isolation system for a communication satellite system according to any one of claims 1 to 7, comprising: Receiving service data transmitted by the communication service network through the first unidirectional firewall, and performing format conversion processing on the service data to obtain internal interface data in a preset format supported by the unidirectional firewall; The internal interface data in the preset format is sent to the one-way firewall so that the one-way firewall forwards it to the external network host system; wherein the external network host system is used to restore the internal interface data in the preset format into business data, and send the restored business data to the external network through a second one-way firewall.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, wherein: When the processor executes the computer program, the steps of the network security one-way isolation method for a communication satellite system as claimed in claim 8 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and when the computer instructions are executed by a processor, the network security one-way isolation method for a communication satellite system according to claim 8 is implemented.

Images