Intranet and extranet information transmission method and device based on isolation control

Abstract

The invention discloses an internal and external network information transmission method and device based on isolation control. The method comprises the following steps: when a connection request from an external network is received, creating a client thread; analyzing the data when determining that the client thread receives the data from the external network; when the data is determined to belong to a legal message based on the data analysis result, packaging the data; forwarding the packaged data to a communication channel, and forwarding the packaged data to an intranet corresponding to the extranet by using the channel for data processing; after the intranet receives the data, de-encapsulation is carried out, and processing is carried out to obtain response data; and after the external network receives the response data, the response data is fed back to the slave station of the external network through the client thread. According to the invention, the technical problem that the industrial control system is difficult to maintain and upgrade and difficult to meet the data high-speed interaction requirement of the high-speed industrial Internet of Things due to the use of a large number of aging equipment and technologies in the industrial control system in the related technology is solved.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to an intranet and extranet information transmission method and device based on isolation control. Background Art

[0002] The rise of the industrial Internet has enabled industrial equipment to achieve a higher degree of connectivity and data sharing, and the application of cloud computing and cloud platforms has enabled industrial control systems to better achieve remote monitoring, data storage and analysis. The development of the above technologies, while providing convenience, also brings certain risks of data leakage.

[0003] For data security, most industrial enterprises have installed isolation cards, isolation control and other equipment to divide the enterprise into two networks: the intranet and the extranet. The intranet is used for internal communication and office automation, and the extranet is used to connect with external industrial equipment and build the industrial Internet. Isolation cards, isolation control and other equipment divide the enterprise into two networks, which to a certain extent solves the possibility of internal data leakage and external attacks. However, in the existing industrial control system, the use of a large number of aging equipment and technologies makes the security maintenance and upgrade of the industrial control system difficult, and the traditional slow data exchange module is also difficult to meet the high-speed data interaction requirements of the high-speed industrial Internet of Things.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide an internal and external network information transmission method and device based on isolation control, so as to at least solve the technical problem in the related art that the use of a large number of aging equipment and technologies in industrial control systems makes the safe maintenance and upgrading of industrial control systems more difficult, and it is difficult to meet the high-speed data interaction requirements of the high-speed industrial Internet of Things.

[0006] According to one aspect of an embodiment of the present invention, a method for transmitting information between an internal and external network based on isolation control is provided, comprising: upon receiving a connection request from an external network, creating a client thread, wherein the client thread is used to communicate with a slave station of the external network; upon determining that the client thread has received data from the external network, parsing the data to obtain a data parsing result; upon determining that the data belongs to a legal message based on the data parsing result, encapsulating the data to obtain the encapsulated data; forwarding the encapsulated data to a communication channel, so as to use the communication channel to forward the encapsulated data to an internal network corresponding to the external network for data processing; after the internal network receives the encapsulated data, decapsulating the encapsulated data, and processing the decapsulated data to obtain response data; after the external network receives the response data, feeding back the response data to the slave station of the external network through the client thread.

[0007] Optionally, the method also includes: when receiving the connection request from the external network, parsing the connection request to obtain a connection request parsing result; when the connection request parsing result indicates that the protocol corresponding to the connection request is the Hypertext Transfer Protocol (http) protocol, obtaining an http protocol access control policy corresponding to the http protocol; parsing the http protocol access control policy to obtain access control information; judging whether to block all http communication protocol data from passing through an isolation device based on the access control information to obtain a first judgment result, wherein the isolation device is a device arranged between the internal network and the external network and used to protect data security.

[0008] Optionally, creating the client thread includes: initializing a transmission control protocol TCP server in the external network according to the access control information, wherein the TCP server is used to monitor the connection request from the external network; and creating the client thread when the connection request from the external network is monitored through the TCP server.

[0009] Optionally, before forwarding the encapsulated data to the communication channel, the internal and external network information transmission method based on isolation control also includes: initializing the communication channel between the high-speed data transmission module, wherein the high-speed data transmission channel is used for data transmission between the internal network and the external network; binding the client thread to the communication channel.

[0010] Optionally, determining that the protocol corresponding to the data is a legal message based on the data analysis result includes at least one of the following: matching the first main station address and the first port number in the data analysis result with the second main station address and the second port in the access control information, respectively, and when the matching result indicates that the first main station address is the same as the second main station address and the first port is the same as the second port, determining that the protocol corresponding to the data is a legal message; matching the first access method in the data analysis result with the second access method in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determining that the protocol corresponding to the data is a legal message; matching the data The first interface name in the parsing result is matched with the second interface name in the access control information, and when the matching result indicates that the first interface name is the same as the second interface name, it is determined that the protocol corresponding to the data is a legal message; the first protocol version in the data parsing result is matched with the second protocol version in the access control information, and when the matching result indicates that the first protocol version is the same as the second protocol version, it is determined that the protocol corresponding to the data is a legal message; the first request header in the data parsing result is matched with the second request header in the access control information, and when the matching result indicates that the first request header is the same as the second request header, it is determined that the protocol corresponding to the data is a legal message.

[0011] Optionally, when it is determined based on the data analysis result that the protocol corresponding to the data belongs to a legal message, the data is encapsulated to obtain the encapsulated data, including: obtaining the first master station address and the first port number of the master station in the intranet; obtaining the slave station address and the slave station port number of the external network through the client thread; encapsulating the data in a predetermined format according to the first master station address, the first port number, the slave station address and the slave station port to obtain the encapsulated data, wherein the predetermined format is: the first master station address|the first port number|the slave station address|the slave station port number|message content.

[0012] Optionally, the encapsulated data is forwarded to a communication channel, and the communication channel is used to forward the encapsulated data to an intranet corresponding to the external network for data processing, including: after the high-speed data transmission module receives the encapsulated data from the communication channel, the encapsulated data is identified as a data stream, and the data stream is transmitted to the intranet through the communication channel for data processing.

[0013] Optionally, after the intranet receives the encapsulated data, the encapsulated data is decapsulated and processed to obtain response data, including: after the intranet monitors the data reception event through the listening thread, the encapsulated data is received; the encapsulated data is decapsulated to obtain the decapsulated data; and the decapsulated data is forwarded to the main station of the intranet so that the decapsulated data is processed by the main station to obtain the response data.

[0014] According to another aspect of an embodiment of the present invention, there is also provided an intranet and extranet information transmission device based on isolation control, comprising: a creation module, for creating a client thread when receiving a connection request from an extranet, wherein the client thread is used to communicate with a slave station of the extranet; a parsing module, for parsing the data to obtain a data parsing result when determining that the client thread receives data from the extranet; an encapsulation module, for encapsulating the data to obtain the encapsulated data when determining that the data belongs to a legal message based on the data parsing result; a first processing module, for forwarding the encapsulated data to a communication channel, so as to use the communication channel to forward the encapsulated data to an intranet corresponding to the extranet for data processing; a second processing module, for decapsulating the encapsulated data after the intranet receives the encapsulated data, and processing the decapsulated data to obtain response data; a feedback module, for feeding back the response data to the slave station of the extranet through the client thread after the extranet receives the response data.

[0015] Optionally, the device also includes: a first parsing unit, used to parse the connection request when receiving the connection request from the external network, and obtain a connection request parsing result; a first acquisition unit, used to obtain an http protocol access control policy corresponding to the hypertext transfer protocol (http) protocol when the connection request parsing result indicates that the protocol corresponding to the connection request is the http protocol; a second parsing unit, used to parse the http protocol access control policy to obtain access control information; a judgment unit, used to judge whether to block all http communication protocol data from passing through an isolation device according to the access control information, and obtain a first judgment result, wherein the isolation device is a device arranged between the internal network and the external network and used to protect data security; a prohibition unit, used to prohibit all http communication protocol data from passing through the isolation device when the first judgment result is to block all http communication protocol data from passing through the isolation device.

[0016] Optionally, the creation unit includes: an acquisition subunit, used to initialize a transmission control protocol TCP server in the external network according to the access control information, wherein the TCP server is used to listen to the connection request from the external network; and a creation subunit, used to create the client thread when the connection request from the external network is listened to through the TCP server.

[0017] Optionally, the intranet and extranet information transmission device based on isolation control also includes: an initialization module, used to initialize the communication channel between the high-speed data transmission module before forwarding the encapsulated data to the communication channel, wherein the high-speed data transmission channel is used for data transmission between the intranet and the extranet; a binding module, used to bind the client thread to the communication channel.

[0018] Optionally, the encapsulation module includes at least one of the following: a first matching unit, used to match the first main station address and the first port number in the data parsing result with the second main station address and the second port in the access control information, respectively, and when the matching result indicates that the first main station address is the same as the second main station address and the first port is the same as the second port, determine that the protocol corresponding to the data belongs to a legal message; a second matching unit, used to match the first access method in the data parsing result with the second access method in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determine that the protocol corresponding to the data belongs to a legal message; a third matching unit, used to match the first main station address and the first port number in the data parsing result with the second main station address and the second port in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determine that the protocol corresponding to the data belongs to a legal message. The first interface name is matched with the second interface name in the access control information, and when the matching result indicates that the first interface name is the same as the second interface name, it is determined that the protocol corresponding to the data is a legal message; a fourth matching unit is used to match the first protocol version in the data parsing result with the second protocol version in the access control information, and when the matching result indicates that the first protocol version is the same as the second protocol version, it is determined that the protocol corresponding to the data is a legal message; a fifth matching unit is used to match the first request header in the data parsing result with the second request header in the access control information, and when the matching result indicates that the first request header is the same as the second request header, it is determined that the protocol corresponding to the data is a legal message.

[0019] Optionally, the encapsulation module includes: a second acquisition unit, used to obtain the first master station address and the first port number of the master station in the intranet; a third acquisition unit, used to obtain the slave station address and the slave station port number of the external network through the client thread; a data encapsulation unit, used to encapsulate data according to the first master station address, the first port number, the slave station address and the slave station port in a predetermined format to obtain the encapsulated data, wherein the predetermined format is: the first master station address | the first port number | the slave station address | the slave station port number | message content.

[0020] Optionally, the first processing module includes: a first processing unit, used to identify the encapsulated data as a data stream after the high-speed data transmission module receives the encapsulated data from the communication channel, and transmit the data stream to the intranet through the communication channel for data processing.

[0021] Optionally, the second processing module includes: a receiving unit, used to receive the encapsulated data after the intranet monitors the data reception event through the listening thread; a decapsulation unit, used to decapsulate the encapsulated data to obtain the decapsulated data; a second processing unit, used to forward the decapsulated data to the main station of the intranet, so that the main station can process the decapsulated data to obtain the response data.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is further provided, wherein the computer-readable storage medium includes a stored program, wherein the program executes any one of the above-mentioned methods for transmitting intranet and extranet information based on isolation control.

[0023] According to another aspect of an embodiment of the present invention, a processor is further provided, the processor being used to run a program, wherein when the program is run, any one of the above-mentioned methods for transmitting internal and external network information based on isolation control is executed.

[0024] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned methods for transmitting internal and external network information based on isolation control.

[0025] In an embodiment of the present invention, when a connection request is received from an external network, a client thread is created, wherein the client thread is used to communicate with a slave station of the external network; when it is determined that the client thread has received data from the external network, the data is parsed to obtain a data parsing result; when it is determined based on the data parsing result that the data belongs to a legal message, the data is encapsulated to obtain encapsulated data; the encapsulated data is forwarded to a communication channel, so as to use the communication channel to forward the encapsulated data to an internal network corresponding to the external network for data processing; after the encapsulated data is received in the internal network, the encapsulated data is decapsulated and the decapsulated data is processed to obtain response data; after the response data is received in the external network, the response data is fed back to the slave station of the external network through the client thread. Through the technical solution provided by the present invention, a new policy control method is added on the basis of the isolation control device. When a connection request from the external network is received, a client thread is created to receive data from the external network, and the data is processed through the internal network corresponding to the external network, so that high-speed data exchange can be carried out between the internal and external networks, thereby achieving the technical effect of secure access control of data, improving the security of the industrial control system and the data interaction efficiency, and further solving the technical problem in the related technology that the use of a large number of aging equipment and technologies in the industrial control system makes the security maintenance and upgrade of the industrial control system more difficult, and it is difficult to meet the high-speed data interaction requirements of the high-speed industrial Internet of Things. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1 It is a hardware structure block diagram of a mobile terminal of an intranet and extranet information transmission method based on isolation control according to an embodiment of the present invention;

[0028] Figure 2 is a flow chart of an intranet and extranet information transmission method based on isolation control according to an embodiment of the present invention;

[0029] Figure 3 is a flowchart of http protocol access control according to an embodiment of the present invention;

[0030] Figure 4 It is a typical deployment diagram of an isolation control device for the http protocol according to an embodiment of the present invention;

[0031] Figure 5 It is a schematic diagram of an intranet and extranet information transmission device based on isolation control according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] As introduced in the background technology, in the related art, the industrial control system uses a large number of aging equipment and technologies, making the security maintenance and upgrade of the industrial control system more difficult, and it is difficult to meet the high-speed data interaction requirements of the high-speed industrial Internet of Things. In view of the above defects, an internal and external network information transmission method and device based on isolation control, a computer-readable storage medium, a processor, and a computer program product are provided in the embodiments of the present invention.

[0035] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0036] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 1 is a hardware structure block diagram of a mobile terminal of an internal and external network information transmission method based on isolation control according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0037] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the internal and external network information transmission method based on isolation control in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks and combinations thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] According to an embodiment of the present invention, a method embodiment of an internal and external network information transmission method based on isolation control is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 2 is a flow chart of an intranet and extranet information transmission method based on isolation control according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0040] Step S202, when receiving a connection request from the external network, creating a client thread, wherein the client thread is used to communicate with the slave station of the external network.

[0041] In this embodiment, when a connection request is received from the external network, a client thread can be created to communicate with the HTTP slave station of the external network to establish a communication connection with the external network slave station, process data requests or commands sent by the slave station, and realize data transmission and interaction.

[0042] Step S204, when it is determined that the client thread receives data from the external network, the data is parsed to obtain a data parsing result.

[0043] In this embodiment, after the client thread receives data from the external network, the data can be parsed according to the http communication protocol to obtain a data parsing result, thereby helping the client thread understand the content of the received data.

[0044] Step S206, when it is determined based on the data analysis result that the data belongs to a legal message, the data is encapsulated to obtain encapsulated data.

[0045] In this embodiment, after data parsing, it can be determined whether the received HTTP protocol data is a legal message based on the data parsing result. When it is determined that the message is legal, the data is encapsulated according to the requirements of the high-speed data transmission module to obtain encapsulated data, so as to improve the efficiency and speed of data transmission. By encapsulating the data, the integrity and accuracy of the data can be ensured, and the possibility of data loss or damage during transmission can be reduced. The encapsulated data can also improve the readability and operability of the data.

[0046] Step S208, forwarding the encapsulated data to the communication channel, so as to utilize the communication channel to forward the encapsulated data to the internal network corresponding to the external network for data processing.

[0047] In this embodiment, the encapsulated data is forwarded to a communication channel between a high-speed data transmission module, and the high-speed data transmission module utilizes the communication channel to forward the encapsulated data to an intranet data processing module corresponding to the external network for data processing, thereby achieving communication and data exchange with the external network, ensuring that the data can be transmitted smoothly and processed correctly.

[0048] Step S210, after receiving the encapsulated data in the intranet, the encapsulated data is decapsulated and the decapsulated data is processed to obtain response data.

[0049] Optionally, the above processing may include operations such as verification, storage, and analysis.

[0050] In this embodiment, after the intranet receives the encapsulated data from the high-speed data transmission module, the data is decapsulated to obtain the real data content of the transmission, and then the decapsulated data is processed to obtain response data, thereby realizing data exchange and communication between different devices in the intranet.

[0051] Step S212, after the external network receives the response data, the response data is fed back to the slave station of the external network through the client thread.

[0052] In this embodiment, after receiving the intranet data response from the high-speed data transmission module through the communication channel, the data is decapsulated, and after obtaining the response message on the external network, the message content is returned to the slave station of the external network through the client thread, thereby realizing data transmission and communication between the intranet and the external network, and helping devices between different networks to exchange and communicate data.

[0053] As can be seen from the above, in an embodiment of the present invention, when a connection request from an external network is received, a client thread is created, wherein the client thread is used to communicate with a slave station of the external network; when it is determined that the client thread has received data from the external network, the data is parsed to obtain a data parsing result; when it is determined based on the data parsing result that the data belongs to a legal message, the data is encapsulated to obtain encapsulated data; the encapsulated data is forwarded to a communication channel, so as to use the communication channel to forward the encapsulated data to an internal network corresponding to the external network for data processing; after the internal network receives the encapsulated data, the encapsulated data is decapsulated, and the decapsulated data is processed to obtain response data; after the external network receives the response data, the response data is fed back to the slave station of the external network through the client thread, thereby achieving the purpose of creating a client thread to receive data from the external network when a connection request from the external network is received, and processing the data through the internal network corresponding to the external network, so that high-speed data exchange can be performed between the internal and external networks, thereby achieving the technical effect of secure access control of data and improving the security and data interaction efficiency of the industrial control system.

[0054] The above-mentioned technical solution provided by the embodiment of the present invention solves the technical problem in the related art that, due to the use of a large number of aging equipment and technologies, the safe maintenance and upgrading of the industrial control system becomes more difficult, and it is difficult to meet the high-speed data interaction requirements of the high-speed industrial Internet of Things.

[0055] According to the above embodiment of the present invention, the method also includes: when receiving a connection request from an external network, parsing the connection request to obtain a connection request parsing result; when the connection request parsing result indicates that the protocol corresponding to the connection request is the Hypertext Transfer Protocol (http) protocol, obtaining an http protocol access control policy corresponding to the http protocol; parsing the http protocol access control policy to obtain access control information; judging whether to block all http communication protocol data from passing through an isolation device based on the access control information to obtain a first judgment result, wherein the isolation device is a device disposed between an internal network and an external network and used to protect data security; when the first judgment result is to block all http communication protocol data from passing through the isolation device, all http communication protocol data is prohibited from passing through the isolation device.

[0056] Figure 3 is a flow chart of http protocol access control according to an embodiment of the present invention, such as Figure 3 As shown, when a connection request from the external network is received, the connection request is parsed to obtain a connection request parsing result. If the protocol corresponding to the connection request is the Hypertext Transfer Protocol (http) protocol, the corresponding http protocol access control policy is obtained and then parsed. According to the access control policy, it is determined whether to prevent all http communication protocol data from passing through the isolation device. If acquisition is prohibited, all http protocol data is prohibited from passing through, and an error message is returned to the intranet master control device to discard the data. Otherwise, a client thread is created to read the protocol data.

[0057] Figure 4 is a typical deployment diagram of an isolation control device for the http protocol according to an embodiment of the present invention, such as Figure 4 As shown, the above-mentioned isolation device is arranged between the intranet and the extranet, and is connected to the switch of the intranet master station and the switch of the extranet slave station.

[0058] In the above embodiment of the present invention, creating a client thread includes: initializing a transmission control protocol TCP server in the external network according to access control information, wherein the TCP server is used to monitor connection requests from the external network; when a connection request from the external network is monitored through the TCP server, creating a client thread.

[0059] In this embodiment, a TCP server can be initialized in the external network according to the access control policy information to monitor the http connection request from the external network, and a client thread is created when a connection request from the external network is received.

[0060] According to the above embodiment of the present invention, before forwarding the encapsulated data to the communication channel, the internal and external network information transmission method based on isolation control also includes: initializing the communication channel between the high-speed data transmission module, wherein the high-speed data transmission channel is used for data transmission between the internal network and the external network; binding the client thread to the communication channel.

[0061] In this embodiment, a communication channel with a high-speed data transmission module may be initialized for high-speed data transmission, and a thread may be bound to the communication channel to enable data transmission and reception, thereby ensuring the stability and reliability of communication.

[0062] According to the above embodiment of the present invention, determining that the protocol corresponding to the data belongs to a legal message based on the data analysis result includes at least one of the following: matching the first main station address and the first port number in the data analysis result with the second main station address and the second port in the access control information, respectively, and when the matching result indicates that the first main station address is the same as the second main station address and the first port is the same as the second port, determining that the protocol corresponding to the data belongs to a legal message; matching the first access method in the data analysis result with the second access method in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determining that the protocol corresponding to the data belongs to a legal message; The first interface name in the data parsing result is matched with the second interface name in the access control information. When the matching result indicates that the first interface name is the same as the second interface name, it is determined that the protocol corresponding to the data is a legal message; the first protocol version in the data parsing result is matched with the second protocol version in the access control information. When the matching result indicates that the first protocol version is the same as the second protocol version, it is determined that the protocol corresponding to the data is a legal message; the first request header in the data parsing result is matched with the second request header in the access control information. When the matching result indicates that the first request header is the same as the second request header, it is determined that the protocol corresponding to the data is a legal message.

[0063] In this embodiment, it is possible to determine whether an http protocol message is a legitimate message, thereby ensuring that the received data complies with the specifications and requirements of the http protocol, helping to detect data integrity, ensuring the security of data transmission, and avoiding system crashes or abnormal situations due to erroneous messages.

[0064] The specific judgment method is as follows: 1) Match the main station address (i.e., the first main station address) and port number (i.e., the first port number) in the data parsing result with the main station address (i.e., the second main station address) and port number (i.e., the second port) in the access policy. If the main station address and the port are the same, the protocol is a legal message. 2) Match the access method (i.e., the first access method) in the data parsing result with the access method (i.e., the second access method) in the access policy. If they are the same, the protocol is a legal message. 3) Match the interface name (i.e., the first interface name) in the data parsing result with the interface name (i.e., the second interface name) in the access policy. If they are the same, the protocol is a legal message. 4) Match the protocol version (i.e., the first protocol version) in the data parsing result with the protocol version (i.e., the second protocol version) in the access policy. If they are the same, the protocol is a legal message. 5) Match the request header in the data parsing result (ie, the first request header) with the request header in the access policy (ie, the second request header). If they are the same, the protocol is a legal message.

[0065] According to the above embodiment of the present invention, when it is determined based on the data analysis result that the protocol corresponding to the data belongs to a legal message, the data is encapsulated to obtain encapsulated data, including: obtaining the first master station address and the first port number of the master station in the intranet; obtaining the slave station address and the slave station port number of the external network through the client thread; encapsulating the data in a predetermined format according to the first master station address, the first port number, the slave station address and the slave station port to obtain the encapsulated data, wherein the predetermined format is: first master station address|first port number|slave station address|slave station port number|message content.

[0066] In this embodiment, the data can be encapsulated according to the requirements of the high-speed data transmission module to ensure that the data can be transmitted smoothly and efficiently during the transmission process, so that the data format and structure conform to the module specifications, adapt to the transmission rate and bandwidth requirements of the high-speed data transmission module, and reduce errors and packet loss during data transmission.

[0067] The specific encapsulation process is as follows: 1) Communicate with the protocol control module to obtain the master station address (i.e., the first master station address), port number (i.e., the first port number) and other information in the intranet. 2) Obtain the slave station address, port number and other information in the external network from the client thread. 3) Encapsulate the data according to [master station address|master station port number|slave station address|slave station port number|message content].

[0068] According to the above-mentioned embodiment of the present invention, the encapsulated data is forwarded to the communication channel, and the communication channel is used to forward the encapsulated data to the intranet corresponding to the external network for data processing, including: after the high-speed data transmission module receives the encapsulated data from the communication channel, the encapsulated data is identified as a data stream, and the data stream is transmitted to the intranet through the communication channel for data processing.

[0069] In this embodiment, after the high-speed data transmission module receives data from the communication channel, the protocol data is identified as a unique data stream based on the physical transmission protocol to ensure that the data can be correctly identified and distinguished during the transmission process to avoid data confusion or loss. It is uniformly transmitted to the intranet data processing module through the corresponding channel, which can avoid data splitting or confusion and reduce data transmission redundancy, thereby improving the efficiency, security and reliability of data transmission and ensuring that the data is correctly transmitted and processed.

[0070] According to the above-mentioned embodiment of the present invention, after the encapsulated data is received in the intranet, the encapsulated data is decapsulated and processed to obtain response data, including: after the data receiving event is monitored by the listening thread in the intranet, the encapsulated data is received; the encapsulated data is decapsulated to obtain the decapsulated data; and the decapsulated data is forwarded to the main station of the intranet so that the main station can process the decapsulated data to obtain response data.

[0071] It should be noted that a listening thread is pre-created in the above-mentioned intranet, which is used to monitor the data receiving events from the high-speed data transmission module in real time. After receiving the event, a client thread is created to receive data from the high-speed data transmission module; the communication channel between the high-speed data transmission module is initialized for high-speed data transmission, and the client thread is bound to the communication channel.

[0072] In this embodiment, after the data receiving event is monitored by the listening thread in the intranet, the received encapsulated data can be decapsulated, a TCP client can be created, a connection channel with the main station can be established, and the message content (i.e., the decapsulated data) can be forwarded to the main station of the intranet so that the main station can process the decapsulated data, 5. Receive response data from the main station.

[0073] The specific method of data decapsulation is as follows: 1) Decapsulate the data according to [master station address | master station port number | slave station address | slave station port number | message content]; 2) Get the master station address and port number; 3) Get the slave station address and port number; 4) Get the message content.

[0074] In addition, after receiving the response data from the main station, the response data needs to be parsed and its legitimacy needs to be checked according to the above-mentioned method for judging the legitimacy of the http protocol message; the data is encapsulated according to the requirements of the high-speed data transmission module and forwarded to the high-speed data transmission module through the communication channel; the high-speed data transmission module receives the data from the communication channel, and according to the physical transmission protocol, the protocol data is identified as a unique data stream, and is uniformly transmitted to the external network data processing module through the corresponding channel.

[0075] like Figure 3 As shown, when the protocol data is read to determine that the protocol message is legal, the data is formatted and encapsulated, response data is received, and the response data is returned to the control host. If the protocol message is illegal, the data is discarded.

[0076] like Figure 4 As shown, the above-mentioned isolation control device integrates a protocol control module and a high-speed data transmission module that use the above-mentioned access control method, provides management functions for http protocol access control policies, provides an operating environment for access control functions, and the management of http access control policies mainly includes enabling, disabling, adding, deleting, modifying, etc.

[0077] Through the technical solution provided by the above-mentioned embodiments of the present invention, a method and an isolation control device for access control of the commonly used HTTP communication protocol are provided. On the basis of the isolation control device, a new policy control method is added, and a high-speed isolation data transmission module is used to realize high-speed data exchange between the internal and external networks, thereby realizing secure access control of the http communication protocol and meeting the high-speed data interaction requirements of the industrial Internet of Things.

[0078] That is, the technical solution provided by the embodiment of the present invention comprehensively considers various factors, adopts appropriate isolation control devices, and advanced access control methods, realizes secure access control of the http communication protocol, supports more convenient deployment methods, reduces customer network transformation costs, and improves user satisfaction; high-speed data interaction meets customers' ever-changing network traffic needs, which not only improves the security of the internal network, but also meets the high-speed data interaction needs of the industrial Internet of Things.

[0079] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0080] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0081] According to an embodiment of the present invention, there is also provided an intranet and extranet information transmission device based on isolation control for implementing the above intranet and extranet information transmission method based on isolation control. Figure 5 is a schematic diagram of an intranet and extranet information transmission device based on isolation control according to an embodiment of the present invention, such as Figure 5 As shown, the device includes: a creation module 501, a parsing module 503, a packaging module 505, a first processing module 507, a second processing module 509 and a feedback module 511. The device for transmitting information between internal and external networks based on isolation control is described below.

[0082] A creation module 501, used for creating a client thread when receiving a connection request from an external network, wherein the client thread is used for communicating with a slave station of the external network;

[0083] The parsing module 503 is used to parse the data and obtain the data parsing result when it is determined that the client thread receives the data from the external network;

[0084] The encapsulation module 505 is used to encapsulate the data to obtain encapsulated data when it is determined that the data belongs to a legal message based on the data analysis result;

[0085] The first processing module 507 is used to forward the encapsulated data to the communication channel, so as to use the communication channel to forward the encapsulated data to the internal network corresponding to the external network for data processing;

[0086] The second processing module 509 is used to decapsulate the encapsulated data after receiving the encapsulated data in the intranet, and process the decapsulated data to obtain response data;

[0087] The feedback module 511 is used to feed back the response data to the slave station of the external network through the client thread after receiving the response data in the external network.

[0088] It should be noted here that the above-mentioned creation module 501, analysis module 503, encapsulation module 505, first processing module 507, second processing module 509 and feedback module 511 correspond to steps S202 to S212 in the above-mentioned embodiments, and the six modules and the corresponding steps implement the same instances and application scenarios, but are not limited to the contents disclosed in the above-mentioned embodiments.

[0089] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, first, a creation module can be used to create a client thread when a connection request from an external network is received, wherein the client thread is used to communicate with a slave station of the external network; then, the parsing module can be used to parse the data when it is determined that the client thread has received data from the external network to obtain a data parsing result; then, the encapsulation module can be used to encapsulate the data when it is determined based on the data parsing result that the protocol corresponding to the data belongs to a legal message to obtain encapsulated data; secondly, the first processing module can be used to forward the encapsulated data to a communication channel, so as to use the communication channel to forward the encapsulated data to an intranet corresponding to the external network for data processing; and After the encapsulated data is received in the intranet by the second processing module, the encapsulated data is decapsulated and the decapsulated data is processed to obtain response data; finally, after the response data is received in the external network by the feedback module, the response data is fed back to the slave station of the external network through the client thread, thereby achieving a method of adding policy control on the basis of the isolation control device, when a connection request from the external network is received, a client thread is created to receive data from the external network, and data processing is performed through the intranet corresponding to the external network, so that high-speed data exchange can be carried out between the internal and external networks, thereby achieving the technical effect of secure access control of data and improving the security of the industrial control system and the data interaction efficiency.

[0090] The above-mentioned technical solution provided by the embodiment of the present invention solves the technical problem in the related art that, due to the use of a large number of aging equipment and technologies, the safe maintenance and upgrading of the industrial control system becomes more difficult, and it is difficult to meet the high-speed data interaction requirements of the high-speed industrial Internet of Things.

[0091] In an optional embodiment, the device also includes: a first parsing unit, which is used to parse the connection request when receiving a connection request from the external network to obtain a connection request parsing result; a first acquisition unit, which is used to obtain the http protocol access control policy corresponding to the http protocol when the connection request parsing result indicates that the protocol corresponding to the connection request is the hypertext transfer protocol (http protocol); a second parsing unit, which is used to parse the http protocol access control policy to obtain access control information; a judgment unit, which is used to judge whether to block all http communication protocol data from passing through the isolation device according to the access control information to obtain a first judgment result, wherein the isolation device is a device arranged between the internal network and the external network and used to protect data security; a prohibition unit, which is used to prohibit all http communication protocol data from passing through the isolation device when the first judgment result is to block all http communication protocol data from passing through the isolation device.

[0092] In an optional embodiment, a creation unit includes: an acquisition subunit, used to initialize a transmission control protocol TCP server in an external network according to access control information, wherein the TCP server is used to listen to connection requests from the external network; a creation subunit, used to create a client thread when a connection request from the external network is listened to through the TCP server.

[0093] In an optional embodiment, the intranet and extranet information transmission device based on isolation control also includes: an initialization module, used to initialize the communication channel between the high-speed data transmission module before forwarding the encapsulated data to the communication channel, wherein the high-speed data transmission channel is used for data transmission between the intranet and the extranet; a binding module, used to bind the client thread to the communication channel.

[0094] In an optional embodiment, the encapsulation module includes at least one of the following: a first matching unit, used to match the first main station address and the first port number in the data parsing result with the second main station address and the second port in the access control information, respectively, and when the matching result indicates that the first main station address is the same as the second main station address and the first port is the same as the second port, determining that the protocol corresponding to the data belongs to a legal message; a second matching unit, used to match the first access method in the data parsing result with the second access method in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determining that the protocol corresponding to the data belongs to a legal message; a third matching unit, used to match the first main station address and the first port number in the data parsing result with the second main station address and the second port in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determining that the protocol corresponding to the data belongs to a legal message. The first interface name in the data parsing result is matched with the second interface name in the access control information, and when the matching result indicates that the first interface name is the same as the second interface name, it is determined that the protocol corresponding to the data is a legal message; the fourth matching unit is used to match the first protocol version in the data parsing result with the second protocol version in the access control information, and when the matching result indicates that the first protocol version is the same as the second protocol version, it is determined that the protocol corresponding to the data is a legal message; the fifth matching unit is used to match the first request header in the data parsing result with the second request header in the access control information, and when the matching result indicates that the first request header is the same as the second request header, it is determined that the protocol corresponding to the data is a legal message.

[0095] In an optional embodiment, the encapsulation module includes: a second acquisition unit, used to obtain the first master station address and the first port number of the master station in the intranet; a third acquisition unit, used to obtain the slave station address and the slave station port number of the external network through the client thread; a data encapsulation unit, used to encapsulate data according to the first master station address, the first port number, the slave station address and the slave station port in a predetermined format to obtain encapsulated data, wherein the predetermined format is: first master station address|first port number|slave station address|slave station port number|message content.

[0096] In an optional embodiment, the first processing module includes: a first processing unit, which is used to identify the encapsulated data as a data stream after the high-speed data transmission module receives the encapsulated data from the communication channel, and transmit the data stream to the intranet through the communication channel for data processing.

[0097] In an optional embodiment, the second processing module includes: a receiving unit, which is used to receive encapsulated data after monitoring a data reception event through a listening thread in the intranet; a decapsulation unit, which is used to decapsulate the encapsulated data to obtain decapsulated data; and a second processing unit, which is used to forward the decapsulated data to the main station of the intranet, so that the main station can process the decapsulated data to obtain response data.

[0098] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is run, any one of the above-mentioned methods for transmitting internal and external network information based on isolation control is executed.

[0099] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, which, when executed by a processor, execute any one of the above-mentioned methods for transmitting internal and external network information based on isolation control.

[0100] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein the program executes any one of the above-mentioned methods for transmitting information between an intranet and an extranet based on isolation control.

[0101] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0102] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: when a connection request is received from an external network, a client thread is created, wherein the client thread is used to communicate with a slave station of the external network; when it is determined that the client thread has received data from the external network, the data is parsed to obtain a data parsing result; when it is determined based on the data parsing result that the data belongs to a legal message, the data is encapsulated to obtain encapsulated data; the encapsulated data is forwarded to a communication channel, so as to use the communication channel to forward the encapsulated data to an intranet corresponding to the external network for data processing; after the intranet receives the encapsulated data, the encapsulated data is decapsulated, and the decapsulated data is processed to obtain response data; after the external network receives the response data, the response data is fed back to the slave station of the external network through the client thread.

[0103] Optionally, in this embodiment, a computer-readable storage medium is configured to store program codes for executing the following steps: upon receiving a connection request from an external network, parsing the connection request to obtain a connection request parsing result; when the connection request parsing result indicates that the protocol corresponding to the connection request is a hypertext transfer protocol (http) protocol, obtaining an http protocol access control policy corresponding to the http protocol; parsing the http protocol access control policy to obtain access control information; judging whether to block all http communication protocol data from passing through an isolation device based on the access control information to obtain a first judgment result, wherein the isolation device is a device disposed between an intranet and an external network and used to protect data security; when the first judgment result is to block all http communication protocol data from passing through the isolation device, all http communication protocol data is prohibited from passing through the isolation device.

[0104] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: initializing a transmission control protocol TCP server in the external network according to access control information, wherein the TCP server is used to listen for connection requests from the external network; when a connection request from the external network is listened to through the TCP server, creating a client thread.

[0105] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: initializing a communication channel with a high-speed data transmission module, wherein the high-speed data transmission channel is used for data transmission between an intranet and an extranet; and binding a client thread to the communication channel.

[0106] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: matching the first main station address and the first port number in the data parsing result with the second main station address and the second port in the access control information, respectively, and when the matching result indicates that the first main station address is the same as the second main station address and the first port is the same as the second port, determining that the protocol corresponding to the data is a legal message; matching the first access method in the data parsing result with the second access method in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determining that the protocol corresponding to the data is a legal message; matching the data The first interface name in the parsing result is matched with the second interface name in the access control information. When the matching result indicates that the first interface name is the same as the second interface name, it is determined that the protocol corresponding to the data is a legal message; the first protocol version in the data parsing result is matched with the second protocol version in the access control information. When the matching result indicates that the first protocol version is the same as the second protocol version, it is determined that the protocol corresponding to the data is a legal message; the first request header in the data parsing result is matched with the second request header in the access control information. When the matching result indicates that the first request header is the same as the second request header, it is determined that the protocol corresponding to the data is a legal message.

[0107] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: obtaining the first master station address and the first port number of the master station in the intranet; obtaining the slave station address and the slave station port number of the external network through the client thread; encapsulating data in a predetermined format according to the first master station address, the first port number, the slave station address and the slave station port to obtain encapsulated data, wherein the predetermined format is: first master station address|first port number|slave station address|slave station port number|message content.

[0108] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for performing the following steps: after the high-speed data transmission module receives encapsulated data from the communication channel, the encapsulated data is identified as a data stream, and the data stream is transmitted to the intranet through the communication channel for data processing.

[0109] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: after the intranet monitors a data reception event through a listening thread, receiving encapsulated data; decapsulating the encapsulated data to obtain decapsulated data; forwarding the decapsulated data to the main station of the intranet, so that the main station can process the decapsulated data to obtain response data.

[0110] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0111] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0112] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0113] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0114] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0115] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0116] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for transmitting information between an internal network and an external network based on isolation control, characterized in that: include: When receiving a connection request from an external network, creating a client thread, wherein the client thread is used to communicate with a slave station of the external network; When it is determined that the client thread receives the data from the external network, the data is parsed to obtain a data parsing result; When it is determined based on the data analysis result that the data belongs to a legal message, encapsulating the data to obtain the encapsulated data; Forwarding the encapsulated data to a communication channel, so as to use the communication channel to forward the encapsulated data to an intranet corresponding to the external network for data processing; After receiving the encapsulated data in the intranet, decapsulate the encapsulated data and process the decapsulated data to obtain response data; After the external network receives the response data, the response data is fed back to the slave station of the external network through the client thread.

2. The method for transmitting information between internal and external networks based on isolation control according to claim 1, characterized in that: Also includes: When receiving the connection request from the external network, parsing the connection request to obtain a connection request parsing result; When the connection request parsing result indicates that the protocol corresponding to the connection request is the Hypertext Transfer Protocol (http) protocol, obtaining an http protocol access control policy corresponding to the http protocol; Parsing the http protocol access control policy to obtain access control information; Determining whether to block all http communication protocol data from passing through an isolation device according to the access control information, and obtaining a first determination result, wherein the isolation device is a device disposed between the intranet and the extranet and used to protect data security; When the first judgment result is to prevent all the http communication protocol data from passing through the isolation device, then all the http communication protocol data are prohibited from passing through the isolation device.

3. The method for transmitting information between internal and external networks based on isolation control according to claim 2, characterized in that: Creating the client thread includes: Initializing a transmission control protocol TCP server in the external network according to the access control information, wherein the TCP server is used to monitor the connection request from the external network; When the connection request from the external network is monitored by the TCP server, the client thread is created.

4. The method for transmitting information between internal and external networks based on isolation control according to claim 1, characterized in that: Before forwarding the encapsulated data to the communication channel, the method further comprises: Initializing the communication channel with the high-speed data transmission module, wherein the high-speed data transmission channel is used for data transmission between the intranet and the extranet; The client thread is bound to the communication channel.

5. The method for transmitting information between internal and external networks based on isolation control according to claim 2, characterized in that: Determining, based on the data analysis result, that the protocol corresponding to the data is a legal message includes at least one of the following: Matching the first main station address and the first port number in the data parsing result with the second main station address and the second port in the access control information respectively, and when the matching result indicates that the first main station address is the same as the second main station address and the first port is the same as the second port, determining that the protocol corresponding to the data belongs to a legal message; Matching the first access method in the data analysis result with the second access method in the access control information, and when the matching result indicates that the first access method is the same as the second access method, determining that the protocol corresponding to the data is a legal message; Matching the first interface name in the data parsing result with the second interface name in the access control information, and when the matching result indicates that the first interface name is the same as the second interface name, determining that the protocol corresponding to the data belongs to a legal message; Matching the first protocol version in the data parsing result with the second protocol version in the access control information, and when the matching result indicates that the first protocol version is the same as the second protocol version, determining that the protocol corresponding to the data belongs to a legal message; The first request header in the data parsing result is matched with the second request header in the access control information, and when the matching result indicates that the first request header is the same as the second request header, it is determined that the protocol corresponding to the data belongs to a legal message.

6. The method for transmitting information between internal and external networks based on isolation control according to claim 1, characterized in that: When it is determined based on the data analysis result that the protocol corresponding to the data belongs to a legal message, encapsulating the data to obtain the encapsulated data includes: Obtaining a first master station address and a first port number of a master station in the intranet; Obtain the slave station address and slave station port number of the external network through the client thread; Data is encapsulated according to the first master station address, the first port number, the slave station address and the slave station port in a predetermined format to obtain the encapsulated data, wherein the predetermined format is: the first master station address | the first port number | the slave station address | the slave station port number | message content.

7. The method for transmitting information between internal and external networks based on isolation control according to claim 1, characterized in that: Forwarding the encapsulated data to a communication channel, so as to use the communication channel to forward the encapsulated data to an intranet corresponding to the external network for data processing, including: After the high-speed data transmission module receives the encapsulated data from the communication channel, it identifies the encapsulated data as a data stream, and transmits the data stream to the intranet through the communication channel for data processing.

8. The method for transmitting information between internal and external networks based on isolation control according to claim 1, characterized in that: After receiving the encapsulated data, the intranet decapsulates the encapsulated data and processes the decapsulated data to obtain response data, including: After the intranet monitors a data receiving event through a monitoring thread, receiving the encapsulated data; Decapsulating the encapsulated data to obtain the decapsulated data; The decapsulated data is forwarded to the main station of the intranet, so that the decapsulated data is processed by the main station to obtain the response data.

9. An intranet and extranet information transmission device based on isolation control, characterized in that: include: A creation module, used for creating a client thread when receiving a connection request from an external network, wherein the client thread is used for communicating with a slave station of the external network; A parsing module, configured to parse the data to obtain a data parsing result when determining that the client thread receives data from the external network; An encapsulation module, used for encapsulating the data to obtain the encapsulated data when it is determined that the data belongs to a legal message based on the data analysis result; A first processing module, used for forwarding the encapsulated data to a communication channel, so as to use the communication channel to forward the encapsulated data to an intranet corresponding to the external network for data processing; A second processing module is used for decapsulating the encapsulated data after the intranet receives the encapsulated data, and processing the decapsulated data to obtain response data; A feedback module is used to feed back the response data to the slave station of the external network through the client thread after the response data is received in the external network.

10. A computer program product comprising computer instructions, characterized in that When the computer instructions are executed by the processor, the internal and external network information transmission method based on isolation control as described in any one of claims 1 to 8 is performed.

Images