Ferry system and ferry method

Abstract

The invention discloses a ferrying system and a ferrying method, the ferrying system comprises a privacy area, an encryption area and a communication area, the privacy area and the communication area are respectively in communication connection with the encryption area, ferrying tools are respectively arranged in the privacy area and the communication area, a communication agent is also arranged in the communication area, and the communication agent is in communication connection with the ferrying tools in the communication area. An encryption and decryption program is arranged in the encryption area; the privacy area is used for ferrying data information and command information to be ferried by using a ferrying tool; the encryption area is used for encrypting or decrypting to-be-ferried data information and command information by using an encryption and decryption program; and the communication area is used for ferrying the to-be-ferried data information and the to-be-ferried command information by using a ferrying tool and a communication agent. According to the method, the KCP is used for replacing a TCP data link, and a data communication channel between the privacy area and the communication area is successfully established; the command information and the data information are transmitted separately, the data information is prevented from occupying a port for a long time, and the system response time is effectively shortened.

Description

Technical Field

[0001] The present application relates to the technical field of data transmission, and in particular to a ferrying system and a ferrying method. Background Art

[0002] The patent with application number 2022109259497 proposes a global quantum security system in hardware form with a confidential area, an isolation area, and a non-confidential area. The system can be used in a quantum security privacy computer.

[0003] Among them, the application of the privacy zone (i.e., secret zone) of the quantum security privacy computer generally communicates with the encryption zone (i.e., isolation zone) through UDP Socket after hardware filtering and isolation, and the communication agent of the communication zone (i.e., non-secret zone) communicates with the encryption zone through Raw Socket after hardware filtering and isolation, and the communication agent forwards the data by packet. Based on the hardware form and communication process of the quantum security privacy computer, due to the existence of the isolation zone, the application programs between the privacy zone and the communication zone cannot establish a data link for direct data communication. In addition, due to security requirements, the establishment of TCP data links for data transmission is not allowed in the quantum security privacy computer. In summary, for the data packets in the privacy zone and the communication zone, the encryption zone and the communication agent only filter and forward according to the rules. There is no data link, no packet assembly, no order preservation, and no reliability and efficiency guarantee during the transmission process.

[0004] Based on the above description, it can be seen that in the hardware form of a quantum secure privacy computer, the privacy zone and the communication zone can neither communicate directly nor guarantee reliability and efficiency. In order to solve this problem, it is urgent to propose a data transmission system to realize the data transmission function between the privacy zone and the communication zone. Summary of the invention

[0005] Purpose of the invention: The present application provides a ferry system and a ferry method to solve the problems mentioned in the background technology.

[0006] Technical solution: The present invention provides a ferrying system, including a privacy zone, an encryption zone and a communication zone, wherein the privacy zone and the communication zone are communicatively connected with the encryption zone respectively, wherein ferrying tools are respectively provided in the privacy zone and the communication zone, and a communication agent is also provided in the communication zone, and the communication agent is communicatively connected with the ferrying tool in the communication zone, and an encryption and decryption program is provided in the encryption zone; the privacy zone is used to ferry data information and command information to be ferryed by using the ferrying tool; the encryption zone is used to encrypt or decrypt data information and command information to be ferryed by using the encryption and decryption program; the communication zone is used to ferry data information and command information to be ferryed by using the ferrying tool and the communication agent.

[0007] As an improvement of the present invention, the ferry tool includes a heartbeat detection module, a monitoring module, a data ferry module and a command ferry module, wherein the heartbeat detection module is communicatively connected to the monitoring module, the monitoring module is communicatively connected to the data ferry module and the command ferry module respectively, and the data ferry module is also communicatively connected to the command ferry module;

[0008] The heartbeat detection module is used to periodically send heartbeat instructions and monitor the heartbeat instruction reply time;

[0009] The monitoring module is used to monitor the data flow process of the port and trigger the data ferry module and the command ferry module;

[0010] The data ferry module is used to ferry data information;

[0011] The command ferry module is used to ferry command information.

[0012] As an improvement of the present invention, the data ferry module includes a data receiving unit, a coding unit, a data stream creation unit, a thread pool, a slice processing unit, a merging processing unit, a data sending unit, and a data storage unit; wherein the data receiving unit is communicatively connected with the coding unit, the coding unit is communicatively connected with the data stream creation unit and the thread pool respectively, the thread pool is communicatively connected with the slice processing unit and the merging processing unit respectively, the slice processing unit is also communicatively connected with the data sending unit, and the merging processing unit is also communicatively connected with the data storage unit;

[0013] The data receiving unit is used to receive data information to be ferried;

[0014] The encoding and decoding unit is used to encode or decode the received data information;

[0015] The data stream creation unit is used to establish a data stream channel;

[0016] The thread pool is used to create, manage and destroy threads;

[0017] The slice processing unit is used to perform zero-copy slice processing on the data information to be ferried, obtain multiple slice data, and add a mark to each slice data;

[0018] The merging processing unit is used to perform zero-copy merging processing on multiple slice data according to the identifier to obtain data information to be ferried;

[0019] The data sending unit is used to send the data information to be ferried;

[0020] The data storage unit is used to receive and store ferry data information.

[0021] As an improvement of the present invention, the command ferry module includes a command receiving unit, a command filtering unit, a control flow creating unit and a command sending unit; wherein the command receiving unit, the command filtering unit, the control flow creating unit and the command sending unit are sequentially connected in communication;

[0022] The command receiving unit is used to receive the command information to be ferryed;

[0023] The command filtering unit is used to filter the command information to be ferried according to the filtering conditions;

[0024] The control flow creation unit is used to establish a control flow channel;

[0025] The command sending unit is used to send the command information to be ferryed.

[0026] As an improvement of the present invention, a ferrying method is also provided, which is applied to the ferrying system described above. The ferrying method includes a preprocessing step and a privacy zone triggering process, wherein:

[0027] The pre-processing step includes the privacy zone sending a heartbeat command to the communication zone through the encryption zone at regular intervals, and monitoring the heartbeat command reply time; at the same time, the privacy zone monitors the privacy zone port in real time, and the communication zone monitors the communication zone port in real time;

[0028] The privacy zone triggering process includes the following steps:

[0029] Step 1: When the privacy zone responds to the heartbeat command within the specified time range and detects new data on the privacy zone port, the data flow process is triggered: the privacy zone establishes a first data flow channel and a first control flow channel with the encryption zone;

[0030] Step 2: The privacy area transfers the command information to be transferred to the encryption area through the first control flow channel, and transfers the data information to be transferred to the encryption area through the first data flow channel. The encryption area encrypts the command information and data information, and forwards the encrypted command information and data information to the communication area.

[0031] As an improvement of the present invention, the ferry method further includes a communication area triggering process, and the communication area triggering data process includes the following steps:

[0032] Step S1: When the communication zone receives the heartbeat command at a fixed time and monitors that there is new data on the communication zone port, the data flow process is triggered: the privacy zone is notified to establish a second control flow channel and a second data flow channel between the privacy zone and the encryption zone through a heartbeat command reply;

[0033] Step S2: The communication area transfers the command information and data information to be transferred to the encryption area. After the encryption area decrypts the command information and data information to be transferred, the command information to be transferred is transferred to the privacy area through the second control flow channel, and the data information to be transferred is transferred to the privacy area through the second data flow channel.

[0034] As an improvement of the present invention, the specific process in step 1 is:

[0035] Step 1-1: When the heartbeat command reply time is within the specified time range and the monitoring module in the ferry tool detects new data on the privacy zone port, the heartbeat detection module in the privacy zone ferry tool sends the data to the data ferry module in the ferry tool and sends the command information to the command ferry module; wherein each piece of data corresponds to the command information one by one; at the same time, the data flow process is triggered and notified to the communication zone via the encryption zone through the heartbeat command;

[0036] Step 1-2: The data receiving unit in the data ferry module in the privacy zone ferry tool sends the received data to the encoding and decoding unit, encodes it and sends it to the data flow creation unit, and the data flow creation unit triggers the establishment of the first data flow channel between the encryption zone; at the same time, the command receiving unit in the command ferry module sends the command information corresponding to the data to the command filtering unit, the command filtering unit filters the command information according to the preset filtering conditions, and sends the command information that passes the filtering to the control flow creation unit, the control flow creation unit triggers the establishment of the first control flow channel between the encryption zone, and the command information enters the command sending unit via the control flow creation unit; the communication zone establishes a third data flow channel and a third control flow channel between the communication zone ferry tool and the communication agent in the communication zone according to the notification;

[0037] Step 1-3: The encoding and decoding unit sends all the encoded data to the thread pool, which creates multiple threads according to the amount of data, fills the multiple data into the multiple threads one by one, and manages the threads; the thread pool sends the multiple data to the slice processing unit according to the thread, and the slice processing unit performs zero-copy slice processing on each data, and each data obtains multiple slice data, and adds an identifier to each slice data;

[0038] Step 1-4: The slice processing unit shuffles the order of the plurality of slice data with labels and sends them to the data sending unit as the data information to be transferred.

[0039] As an improvement of the present invention, the specific process of step 2 is:

[0040] Step 2-1: The command sending unit in the privacy zone ferry tool ferries the command information to be ferried to the encryption zone through the first control flow channel, and the data sending unit in the privacy zone ferry tool ferries the data information to be ferried to the encryption zone through the first data flow channel;

[0041] Step 2-2: The encryption and decryption program in the encryption area encrypts the command information to be ferried and the data information to be ferried except the identification, and then sends it to the communication agent in the communication area;

[0042] Step 2-3: The communication agent ferries the encrypted command information to the command ferry module in the communication area ferry tool through the third control flow channel, and ferries the encrypted data information to the data ferry module in the communication area ferry tool through the third data flow channel;

[0043] Step 2-4: The data ferry module in the communication area ferry tool sends the received encrypted data information to the encoding and decoding unit via the data receiving unit for decoding. The thread pool then manages the decoded data information and sends it to the merging processing unit. The merging processing unit performs zero-copy merging processing on multiple slice data according to the identifier to obtain complete data information and send it to the data storage unit.

[0044] As an improvement of the present invention, the specific process of step S1 is as follows:

[0045] Step S1-1: When the heartbeat detection module in the communication area ferry tool receives the heartbeat command regularly and the monitoring module in the ferry tool monitors that there is new data on the communication area port, the data flow process is triggered: the data is sent to the data ferry module in the ferry tool, and the command information is sent to the command ferry module; wherein each piece of data corresponds to the command information one by one; at the same time, the data flow process is triggered by replying the heartbeat command to notify the privacy area via the encryption area;

[0046] Step S1-2: the data receiving unit in the data ferry module in the privacy zone ferry tool sends the received data information to the encoding and decoding unit, encodes it and sends it to the data flow creation unit, and the data flow creation unit triggers the establishment of a fourth data flow channel with the communication agent; at the same time, the command receiving unit in the command ferry module sends the command information corresponding to the data to the command filtering unit, the command filtering unit filters the command information according to the preset filtering conditions, and sends the command information that passes the filtering to the control flow creation unit, the control flow creation unit triggers the establishment of a fourth control flow channel with the communication agent, and the command information enters the command sending unit via the control flow creation unit; the privacy zone establishes the second data flow channel and the second control flow channel between the privacy zone ferry tool and the encryption zone according to the notification;

[0047] Step S1-3: The encoding and decoding unit sends all the encoded data to the thread pool, which creates multiple threads according to the number of data information, fills the multiple data information into the multiple threads one by one, and manages the threads by the thread pool; the thread pool sends the multiple data information to the slice processing unit according to the thread, and the slice processing unit performs zero-copy slice processing on the data information, obtains multiple slice data for each data, and adds an identifier to each slice data;

[0048] Step S1-4: the slice processing unit shuffles the order of the plurality of slice data with labels and sends them to the data sending unit as data information to be transferred.

[0049] As an improvement of the present invention, the specific process of step S2 is as follows:

[0050] Step S2-1: the command sending unit in the communication area ferry tool ferries the command information to the communication agent through the fourth control flow channel, and the data sending unit in the communication area ferry tool ferries the data information to be ferried to the communication agent through the fourth data flow channel;

[0051] Step S2-2: The communication agent in the communication area sends the command information and the data information to be ferried to the encryption area;

[0052] Step S2-3: After the encryption and decryption program in the encryption area decrypts the command information to be ferried and the data information to be ferried except the identifier, the decrypted command information is ferried to the command ferry module in the privacy area ferry tool through the second control flow channel, and the decrypted data information is ferried to the data ferry module in the privacy area ferry tool through the second data flow channel;

[0053] Step S2-4: The data ferry module in the privacy zone ferry tool sends the received decrypted data information to the encoding and decoding unit via the data receiving unit for decoding. The thread pool then manages the decoded data information and sends it to the merging processing unit. The merging processing unit performs zero-copy merging processing on multiple slice data according to the identifier to obtain complete data information and send it to the data storage unit.

[0054] Beneficial effects:

[0055] 1. Use the KCP protocol instead of the TCP data link to successfully build a data communication channel between the privacy zone and the communication zone. At the same time, KCP can specify the MTU size to send, avoiding system overload caused by sending too much data;

[0056] 2. Command information and data information are transmitted through their own channels respectively. Command transmission and data transmission are distinguished. Command information notifies each other through UDP stream, and data information is sent to each other through KCP stream. User operations can reach the other end in real time and control data information through command information, avoiding data information occupying ports for a long time, reducing the waiting time for command messages, effectively shortening system response time, improving system operation efficiency, and greatly improving user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0058] Figure 1 This is a schematic diagram of the structure of the ferry system for this application;

[0059] Figure 2 This is a schematic diagram of the structure of the ferry tool for this application;

[0060] Figure 3 A flowchart of the pre-processing steps and the privacy zone triggering process of the ferrying method of this application;

[0061] Figure 4 Schematic diagram of the preprocessing steps and communication area triggering process of the ferry method of this application DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0063] like Figure 1As shown, the present invention provides a ferrying system, which includes a privacy zone, an encryption zone and a communication zone, wherein the privacy zone and the communication zone are respectively communicatively connected with the encryption zone, wherein ferrying tools are respectively arranged in the privacy zone and the communication zone, and a communication agent is also arranged in the communication zone, and the communication agent is communicatively connected with the ferrying tool in the communication zone, and an encryption and decryption program is arranged in the encryption zone; the privacy zone is used for ferrying data information and command information to be ferryed by using the ferrying tool; the encryption zone is used for encrypting or decrypting data information and command information to be ferryed by using the encryption and decryption program; the communication zone is used for ferrying data information and command information to be ferryed by using the ferrying tool and the communication agent.

[0064] like Figure 2 As shown, in the privacy zone and the communication zone, the ferry tool includes a heartbeat detection module, a monitoring module, a data ferry module and a command ferry module, wherein the heartbeat detection module is connected to the monitoring module in communication, the monitoring module is connected to the data ferry module and the command ferry module in communication, and the data ferry module is also connected to the command ferry module in communication. The heartbeat detection module is used to send heartbeat instructions regularly and monitor the duration of the heartbeat instruction reply. The system of the present invention determines whether the communication is open based on whether the heartbeat detection module can send the heartbeat instruction and receive the heartbeat instruction reply within the specified time. The path of the heartbeat instruction can be a separate data channel, or it can be a control flow channel that is the same as the command information. The monitoring module is used to monitor the port and trigger the data flow process of the data ferry module and the command ferry module. In an embodiment of the present invention, the port includes a UDP port and a KCP port, that is, the monitoring module monitors both the UDP port and the KCP port, and triggers the data flow process of the system when it monitors that either the UDP port or the KCP port has new data. The data flow process includes establishing a data flow channel and ferrying data information, as well as establishing a control flow channel and ferrying command information.

[0065] In the ferry tool of the present invention, the data ferry module is used to ferry data information. The data ferry module includes a data receiving unit, a codec unit, a data stream creation unit, a thread pool, a slice processing unit, a merge processing unit, a data sending unit and a data storage unit. The data receiving unit is connected to the codec unit in communication, and the codec unit is connected to the data stream creation unit and the thread pool in communication, and the thread pool is connected to the slice processing unit and the merge processing unit in communication, and the slice processing unit is also connected to the data sending unit in communication, and the merge processing unit is also connected to the data storage unit in communication. The data receiving unit is used to receive the data information to be ferryed, and temporarily store and forward the data information to be ferryed. The codec unit is used to encode or decode the received data information; in an embodiment of the present invention, the codec method is, for example, KLV. The data stream creation unit is used to establish a data stream channel to provide a path for the ferrying of data information. In an embodiment of the present invention, the data stream channel is, for example, a KCP data stream channel. The thread pool is used to create, manage and destroy threads. When there are many data information, multiple threads are created and managed to provide multi-threaded concurrent processing to improve system operation efficiency. When the amount of data information is small, the thread is destroyed to reduce the system resources. The slice processing unit is used to perform zero-copy slice processing on the data information to be ferried, obtain multiple slice data, and add an identifier to each slice data. It should be noted that subsequent encryption and decryption operations in the system do not operate on the identifiers of data and commands to improve the system operation efficiency. The merge processing unit is used to perform zero-copy merge processing on multiple slice data according to the identifier to obtain the data information to be ferried. The data sending unit is used to send the data information to be ferried. The data storage unit is used to receive and store the ferried data information.

[0066] The command ferry module is used to ferry command information. The command ferry module includes a command receiving unit, a command filtering unit, a control flow creation unit and a command sending unit; wherein the command receiving unit, the command filtering unit, the control flow creation unit and the command sending unit are sequentially connected in communication; the command receiving unit is also connected in communication with the data receiving unit to obtain the one-to-one correspondence between data and command information. The command receiving unit is used to receive command information to be ferryed. The command filtering unit is used to filter the command information to be ferryed according to the filtering condition; the filtering condition may include matching the format of the command information, for example, whether the field sequence of the command message satisfies the field sequence set in the filtering condition; the filtering condition may include matching at least one field content in the command information (for example, src field, Msg field, etc.), for example, whether at least one field content of the command message is the content set in the filtering condition, if the match is successful, the filtering condition passes and the filtering operation is performed; otherwise, the filtering operation is refused to be performed. The control flow creation unit is used to establish a control flow channel to provide a path for the ferrying of command information. In an embodiment of the present invention, the control flow channel is, for example, a UDP control flow channel. The command sending unit is used to send the command information to be ferryed.

[0067] In an embodiment of the present invention, KCP is a fast and reliable ARQ protocol. Compared with TCP, it wastes 10%-20% bandwidth in exchange for 30%-40% transmission speed. However, for information security reasons, quantum privacy computers do not allow the establishment of TCP data links. The ferry tool of the present invention uses the UDP protocol, and KCP can be regarded as an application layer protocol, and its bottom layer is UDP transmission. At the same time, KCP can specify the MTU size of the transmission. The ferry tool of the present invention supports functions such as user pause, restart, cancel and breakpoint continuation, distinguishes data transmission from command transmission, and can achieve real-time response. The command information and data information are not in the same channel. The command information notifies each other through the UDP stream, and the data information is sent to each other through the KCP stream. The user operation can reach the opposite end in real time through the command information and control the data information. If the paths of command and data information are not distinguished, the long-term occupation of the port by the data information will cause the command information to wait in line, and the system response time is too long, affecting the user experience.

[0068] like Figure 3 As shown, after the ferry tool of the present invention is started, a command information channel and a data information channel need to be established. Therefore, the present invention also provides a ferry method, which is applied to the ferry system proposed above in the present invention. The ferry method includes a preprocessing step and a privacy zone triggering process, wherein:

[0069] The pre-processing step includes the privacy zone sending a heartbeat command to the communication zone through the encryption zone at regular intervals, and monitoring the heartbeat command reply time; at the same time, the privacy zone monitors the privacy zone port in real time, and the communication zone monitors the communication zone port in real time;

[0070] As described above, the preprocessing step is mainly performed by the heartbeat detection module and the monitoring module.

[0071] The privacy zone triggering process includes the following steps:

[0072] Step 1: When the privacy zone responds to the heartbeat command within the specified time range and detects new data on the privacy zone port, the data flow process is triggered: the privacy zone establishes a first data flow channel and a first control flow channel with the encryption zone.

[0073] Specifically, step 1 includes the following:

[0074] Step 1-1: When the heartbeat command reply time is within the specified time range and the monitoring module in the ferry tool detects new data on the privacy zone port, the heartbeat detection module in the privacy zone ferry tool sends the data to the data ferry module in the ferry tool and sends the command information to the command ferry module; wherein each piece of data corresponds to the command information one by one; at the same time, the data flow process is triggered and notified to the communication zone via the encryption zone through the heartbeat command;

[0075] Step 1-2: The data receiving unit in the data ferry module in the privacy zone ferry tool sends the received data to the encoding and decoding unit, encodes the data and sends it to the data flow creation unit, and the data flow creation unit triggers the establishment of the first data flow channel between the encryption zone; at the same time, the command receiving unit in the command ferry module sends the command information corresponding to the data to the command filtering unit, the command filtering unit filters the command information according to the preset filtering conditions, and sends the command information that passes the filtering to the control flow creation unit, the control flow creation unit triggers the establishment of the first control flow channel between the encryption zone, and the command information enters the command sending unit via the control flow creation unit; the communication zone establishes the third data flow channel and the third control flow channel between the communication zone ferry tool and the communication agent in the communication zone according to the notification; in this embodiment, the communication zone establishes the third data flow channel and the third control flow channel in a manner that is substantially the same as the first data flow channel and the first control flow channel, and will not be described in detail herein.

[0076] Step 1-3: The encoding and decoding unit sends all the encoded data to the thread pool, which creates multiple threads according to the amount of data, fills the multiple data into the multiple threads one by one, and manages the threads; the thread pool sends the multiple data to the slicing processing unit according to the thread, and the slicing processing unit performs zero-copy slicing processing on each data, and each data obtains multiple slices of data, and adds an identifier to each slice of data; after the zero-copy slicing processing, the size of each data is consistent, for example, 10MB.

[0077] Step 1-4: The slice processing unit sends multiple slice data with identifiers in a random order as data information to be ferryed to the data sending unit. When ferrying data information, the data information is sent through the data stream channel, and each time a slice data is sent, the control stream channel waits for the reply information before sending the next slice.

[0078] Step 2: The privacy area transfers the command information to be transferred to the encryption area through the first control flow channel, and transfers the data information to be transferred to the encryption area through the first data flow channel. The encryption area encrypts the command information and data information, and forwards the encrypted command information and data information to the communication area.

[0079] Specifically, step 2 includes the following:

[0080] Step 2-1: The command sending unit in the privacy zone ferry tool ferries the command information to be ferried to the encryption zone through the first control flow channel, and the data sending unit in the privacy zone ferry tool ferries the data information to be ferried to the encryption zone through the first data flow channel;

[0081] Step 2-2: The encryption and decryption program in the encryption area encrypts the command information to be ferried and the data information to be ferried except the identification, and then sends it to the communication agent in the communication area;

[0082] Step 2-3: The communication agent ferries the encrypted command information to the command ferry module in the communication area ferry tool through the third control flow channel, and ferries the encrypted data information to the data ferry module in the communication area ferry tool through the third data flow channel;

[0083] Step 2-4: The data ferry module in the communication area ferry tool sends the received encrypted data information to the encoding and decoding unit via the data receiving unit for decoding. The thread pool then manages the decoded data information and sends it to the merging processing unit. The merging processing unit performs zero-copy merging processing on multiple slice data according to the identifier to obtain complete data information and send it to the data storage unit. The communication area ferry tool receives data through the data flow channel, performs zero-copy merging processing on each slice data received, and replies information through the control flow channel to ensure that each slice data is received accurately.

[0084] like Figure 4 As shown, in an embodiment of the present invention, the ferry method further includes a communication area triggering process, and the communication area triggering data process includes the following steps:

[0085] Step S1: When the communication zone receives the heartbeat command at a fixed time and monitors that there is new data on the communication zone port, the data flow process is triggered: the privacy zone is notified to establish a second control flow channel and a second data flow channel between the privacy zone and the encryption zone through a heartbeat command reply;

[0086] Specifically, step S1 includes the following:

[0087] Step S1-1: When the heartbeat detection module in the communication area ferry tool receives the heartbeat command regularly and the monitoring module in the ferry tool monitors that there is new data on the communication area port, the data flow process is triggered: the data is sent to the data ferry module in the ferry tool, and the command information is sent to the command ferry module; wherein each piece of data corresponds to the command information one by one; at the same time, the data flow process is triggered by replying the heartbeat command to notify the privacy area via the encryption area;

[0088] Step S1-2: the data receiving unit in the data ferry module in the privacy zone ferry tool sends the received data information to the encoding and decoding unit, encodes it and sends it to the data flow creation unit, and the data flow creation unit triggers the establishment of a fourth data flow channel between the communication agent; at the same time, the command receiving unit in the command ferry module sends the command information corresponding to the data to the command filtering unit, the command filtering unit filters the command information according to the preset filtering conditions, and sends the command information that passes the filtering to the control flow creation unit, the control flow creation unit triggers the establishment of a fourth control flow channel between the communication agent, and the command information enters the command sending unit via the control flow creation unit; the privacy zone establishes the second data flow channel and the second control flow channel between the privacy zone ferry tool and the encryption zone according to the notification; in this embodiment, the way in which the privacy zone establishes the second data flow channel and the second control flow channel is basically the same as the way in which the first data flow channel and the first control flow channel are established in step 1, and will not be repeated here.

[0089] Step S1-3: The encoding and decoding unit sends all the encoded data to the thread pool, which creates multiple threads according to the number of data information, fills the multiple data information into the multiple threads one by one, and manages the threads by the thread pool; the thread pool sends the multiple data information to the slice processing unit according to the thread, and the slice processing unit performs zero-copy slice processing on the data information, obtains multiple slice data for each data, and adds an identifier to each slice data;

[0090] Step S1-4: the slice processing unit shuffles the order of the plurality of slice data with labels and sends them to the data sending unit as data information to be transferred.

[0091] Step S2: The communication area transfers the command information and data information to be transferred to the encryption area. After the encryption area decrypts the command information and data information to be transferred, the command information to be transferred is transferred to the privacy area through the second control flow channel, and the data information to be transferred is transferred to the privacy area through the second data flow channel.

[0092] Specifically, step S2 includes the following:

[0093] Step S2-1: the command sending unit in the communication area ferry tool ferries the command information to the communication agent through the fourth control flow channel, and the data sending unit in the communication area ferry tool ferries the data information to be ferried to the communication agent through the fourth data flow channel;

[0094] Step S2-2: The communication agent in the communication area sends the command information and the data information to be ferried to the encryption area;

[0095] Step S2-3: After the encryption and decryption program in the encryption area decrypts the command information to be ferried and the data information to be ferried except the identifier, the decrypted command information is ferried to the command ferry module in the privacy area ferry tool through the second control flow channel, and the decrypted data information is ferried to the data ferry module in the privacy area ferry tool through the second data flow channel;

[0096] Step S2-4: The data ferry module in the privacy zone ferry tool sends the received decrypted data information to the encoding and decoding unit via the data receiving unit for decoding. The thread pool then manages the decoded data information and sends it to the merging processing unit. The merging processing unit performs zero-copy merging processing on multiple slice data according to the identifier to obtain complete data information and send it to the data storage unit.

[0097] In an embodiment of the present invention, the use of KCP stream ferrying data information and UDP message ferrying command information can not only facilitate the control of business processes, but also improve the efficiency and real-time performance of file ferrying. When sending large file data using KCP stream processing, if two machines are directly connected, the bandwidth is close to the speed limit, that is, close to the maximum speed that the network card can transmit. In the hardware form of a quantum security privacy computer, the final file transmission rate of a gigabit network card can reach up to 500+Mb / s. KCP's reliable transmission ensures the stability and reliability of data transmission. Coupled with secure coding and existing hardware security strategies, the security and stability of file ferrying are greatly improved.

Claims

1. A ferry system, characterized in that: It includes a privacy area, an encryption area and a communication area, and the privacy area and the communication area are respectively communicatively connected with the encryption area, wherein ferry tools are respectively provided in the privacy area and the communication area, and a communication agent is also provided in the communication area, and the communication agent is communicatively connected with the ferry tool in the communication area, and an encryption and decryption program is provided in the encryption area; the privacy area is used to ferry data information and command information to be ferryed by using the ferry tool; the encryption area is used to encrypt or decrypt data information and command information to be ferryed by using the encryption and decryption program; the communication area is used to ferry data information and command information to be ferryed by using the ferry tool and the communication agent.

2. The ferry system according to claim 1, characterized in that: The ferry tool includes a heartbeat detection module, a monitoring module, a data ferry module and a command ferry module, wherein the heartbeat detection module is communicatively connected to the monitoring module, the monitoring module is communicatively connected to the data ferry module and the command ferry module respectively, and the data ferry module is also communicatively connected to the command ferry module; The heartbeat detection module is used to periodically send heartbeat instructions and monitor the heartbeat instruction reply time; The monitoring module is used to monitor the data flow process of the port and trigger the data ferry module and the command ferry module; The data ferry module is used to ferry data information; The command ferry module is used to ferry command information.

3. The ferry system according to claim 2, characterized in that: The data ferry module includes a data receiving unit, a codec unit, a data stream creation unit, a thread pool, a slice processing unit, a merging processing unit, a data sending unit, and a data storage unit; wherein the data receiving unit is communicatively connected to the codec unit, the codec unit is communicatively connected to the data stream creation unit and the thread pool respectively, the thread pool is communicatively connected to the slice processing unit and the merging processing unit respectively, the slice processing unit is also communicatively connected to the data sending unit, and the merging processing unit is also communicatively connected to the data storage unit; The data receiving unit is used to receive data information to be ferried; The encoding and decoding unit is used to encode or decode the received data information; The data stream creation unit is used to establish a data stream channel; The thread pool is used to create, manage and destroy threads; The slice processing unit is used to perform zero-copy slice processing on the data information to be ferried, obtain multiple slice data, and add a mark to each slice data; The merging processing unit is used to perform zero-copy merging processing on multiple slice data according to the identifier to obtain data information to be ferried; The data sending unit is used to send the data information to be ferried; The data storage unit is used to receive and store ferry data information.

4. The ferry system according to claim 2, characterized in that: The command ferry module includes a command receiving unit, a command filtering unit, a control flow creating unit and a command sending unit; wherein the command receiving unit, the command filtering unit, the control flow creating unit and the command sending unit are sequentially connected in communication; The command receiving unit is used to receive the command information to be ferryed; The command filtering unit is used to filter the command information to be ferried according to the filtering conditions; The control flow creation unit is used to establish a control flow channel; The command sending unit is used to send the command information to be ferryed.

5. A ferrying method, applied to the ferrying system according to any one of claims 1 to 4, characterized in that: The ferrying method includes a preprocessing step and a privacy zone triggering process, wherein: The pre-processing step includes the privacy zone sending a heartbeat command to the communication zone through the encryption zone at regular intervals, and monitoring the heartbeat command reply time; at the same time, the privacy zone monitors the privacy zone port in real time, and the communication zone monitors the communication zone port in real time; The privacy zone triggering process includes the following steps: Step 1: When the privacy zone responds to the heartbeat command within the specified time range and detects new data on the privacy zone port, the data flow process is triggered: the privacy zone establishes a first data flow channel and a first control flow channel with the encryption zone; Step 2: The privacy area transfers the command information to be transferred to the encryption area through the first control flow channel, and transfers the data information to be transferred to the encryption area through the first data flow channel. The encryption area encrypts the command information and data information, and forwards the encrypted command information and data information to the communication area.

6. The ferrying method according to claim 5, characterized in that: The ferry method further includes a communication area triggering process, and the communication area triggering data process includes the following steps: Step S1: When the communication zone receives the heartbeat command at a fixed time and monitors that there is new data on the communication zone port, the data flow process is triggered: the privacy zone is notified to establish a second control flow channel and a second data flow channel between the privacy zone and the encryption zone through a heartbeat command reply; Step S2: The communication area transfers the command information and data information to be transferred to the encryption area. After the encryption area decrypts the command information and data information to be transferred, the command information to be transferred is transferred to the privacy area through the second control flow channel, and the data information to be transferred is transferred to the privacy area through the second data flow channel.

7. The ferrying method according to claim 5, characterized in that: The specific process in step 1 is: Step 1-1: When the heartbeat command reply time is within the specified time range and the monitoring module in the ferry tool detects new data on the privacy zone port, the heartbeat detection module in the privacy zone ferry tool sends the data to the data ferry module in the ferry tool and sends the command information to the command ferry module; wherein each piece of data corresponds to the command information one by one; at the same time, the data flow process is triggered and notified to the communication zone via the encryption zone through the heartbeat command; Step 1-2: The data receiving unit in the data ferry module in the privacy zone ferry tool sends the received data to the encoding and decoding unit, encodes it and sends it to the data flow creation unit, and the data flow creation unit triggers the establishment of the first data flow channel between the encryption zone; at the same time, the command receiving unit in the command ferry module sends the command information corresponding to the data to the command filtering unit, the command filtering unit filters the command information according to the preset filtering conditions, and sends the command information that passes the filtering to the control flow creation unit, the control flow creation unit triggers the establishment of the first control flow channel between the encryption zone, and the command information enters the command sending unit via the control flow creation unit; the communication zone establishes a third data flow channel and a third control flow channel between the communication zone ferry tool and the communication agent in the communication zone according to the notification; Step 1-3: The encoding and decoding unit sends all the encoded data to the thread pool, which creates multiple threads according to the amount of data, fills the multiple data into the multiple threads one by one, and manages the threads; the thread pool sends the multiple data to the slice processing unit according to the thread, and the slice processing unit performs zero-copy slice processing on each data, and each data obtains multiple slice data, and adds an identifier to each slice data; Step 1-4: The slice processing unit shuffles the order of the plurality of slice data with labels and sends them to the data sending unit as the data information to be transferred.

8. The ferrying method according to claim 7, characterized in that: The specific process of step 2 is as follows: Step 2-1: The command sending unit in the privacy zone ferry tool ferries the command information to be ferried to the encryption zone through the first control flow channel, and the data sending unit in the privacy zone ferry tool ferries the data information to be ferried to the encryption zone through the first data flow channel; Step 2-2: The encryption and decryption program in the encryption area encrypts the command information to be ferried and the data information to be ferried except the identification, and then sends it to the communication agent in the communication area; Step 2-3: The communication agent ferries the encrypted command information to the command ferry module in the communication area ferry tool through the third control flow channel, and ferries the encrypted data information to the data ferry module in the communication area ferry tool through the third data flow channel; Step 2-4: The data ferry module in the communication area ferry tool sends the received encrypted data information to the encoding and decoding unit via the data receiving unit for decoding. The thread pool then manages the decoded data information and sends it to the merging processing unit. The merging processing unit performs zero-copy merging processing on multiple slice data according to the identifier to obtain complete data information and send it to the data storage unit.

9. The ferrying method according to claim 6, characterized in that: The specific process of step S1 is as follows: Step S1-1: When the heartbeat detection module in the communication area ferry tool receives the heartbeat command regularly and the monitoring module in the ferry tool monitors that there is new data on the communication area port, the data flow process is triggered: the data is sent to the data ferry module in the ferry tool, and the command information is sent to the command ferry module; wherein each piece of data corresponds to the command information one by one; at the same time, the data flow process is triggered by replying the heartbeat command to notify the privacy area via the encryption area; Step S1-2: the data receiving unit in the data ferry module in the privacy zone ferry tool sends the received data information to the encoding and decoding unit, encodes it and sends it to the data flow creation unit, and the data flow creation unit triggers the establishment of a fourth data flow channel with the communication agent; at the same time, the command receiving unit in the command ferry module sends the command information corresponding to the data to the command filtering unit, the command filtering unit filters the command information according to the preset filtering conditions, and sends the command information that passes the filtering to the control flow creation unit, the control flow creation unit triggers the establishment of a fourth control flow channel with the communication agent, and the command information enters the command sending unit via the control flow creation unit; the privacy zone establishes the second data flow channel and the second control flow channel between the privacy zone ferry tool and the encryption zone according to the notification; Step S1-3: The encoding and decoding unit sends all the encoded data to the thread pool, which creates multiple threads according to the number of data information, fills the multiple data information into the multiple threads one by one, and manages the threads by the thread pool; the thread pool sends the multiple data information to the slice processing unit according to the thread, and the slice processing unit performs zero-copy slice processing on the data information, obtains multiple slice data for each data, and adds an identifier to each slice data; Step S1-4: the slice processing unit shuffles the order of the plurality of slice data with labels and sends them to the data sending unit as data information to be transferred.

10. The ferry method according to claim 9, characterized in that: The specific process of step S2 is: Step S2-1: the command sending unit in the communication area ferry tool ferries the command information to the communication agent through the fourth control flow channel, and the data sending unit in the communication area ferry tool ferries the data information to be ferried to the communication agent through the fourth data flow channel; Step S2-2: The communication agent in the communication area sends the command information and the data information to be ferried to the encryption area; Step S2-3: After the encryption and decryption program in the encryption area decrypts the command information to be ferried and the data information to be ferried except the identifier, the decrypted command information is ferried to the command ferry module in the privacy area ferry tool through the second control flow channel, and the decrypted data information is ferried to the data ferry module in the privacy area ferry tool through the second data flow channel; Step S2-4: The data ferry module in the privacy zone ferry tool sends the received decrypted data information to the encoding and decoding unit via the data receiving unit for decoding. The thread pool then manages the decoded data information and sends it to the merging processing unit. The merging processing unit performs zero-copy merging processing on multiple slice data according to the identifier to obtain complete data information and send it to the data storage unit.

Images