Internal and external network data interaction method

Abstract

An internal and external network data interaction method is applied to a network with a security isolation device, the network comprises an external network and an internal network, and the external network and the internal network are connected through the security isolation device which can only use standard SQL statements. Wherein the extranet comprises an extranet application server, and the extranet application server is connected with the intranet through a security isolation device; the intranet comprises an intranet database and an intranet application server, and the intranet data server is connected with the intranet application server and is connected with the extranet through a security isolation device; the method comprises the following steps: determining a data transmission mode according to the type of data; wherein the types of the data comprise structured data, unstructured data and real-time task data.

Description

Technical Field

[0001] The present application relates to the field of information technology, and in particular to a method for interacting with intranet and extranet data. Background Art

[0002] In recent years, Internet technology has flourished. The high degree of sharing and rapid transmission of information has brought great convenience to people, but it has also brought a series of network security issues. Network security issues such as system intrusion and information leakage have attracted more and more attention.

[0003] In response to this network problem, many security tools have emerged. Among them, network security isolation, as a network security technology developed in China in recent years, will play an extremely important role in the field of information security. In order to further improve the security and reliability of the information network, the State Grid Corporation of China customized and developed the SQL proxy version of the information security network isolation device, using the technical architecture of the interface proxy to replace the JDBC driver accessed by the client, and perform actual database access through the SGI-NDS200 device. It also performs deep filtering and comprehensive detection of access to control the interactive data between the internal and external networks. Therefore, the data of the internal and external networks can only interact by connecting to the virtual database in the isolation network gate and using SQL add, delete, modify and query statements.

[0004] The security of the national power grid is related to the national economy and people's livelihood, and its security is very important; and the power grid will inevitably have internal and external network data, so how to ensure the security of internal network data becomes crucial. Summary of the invention

[0005] In order to improve the security of the State Grid's intranet data, this application provides a method for interacting with intranet and extranet data.

[0006] In order to achieve the above-mentioned purpose, the embodiment of the present application proposes a method for data interaction between an internal and external network, which is applied to a network with a security isolation device, wherein the network includes an external network and an internal network, and the external network and the internal network are connected through a security isolation device that can only use standard SQL statements;

[0007] The external network includes an external network application server, which is connected to the internal network through a security isolation device; the internal network includes an internal network database and an internal network application server, which is connected to the internal network application server and connected to the external network through a security isolation device;

[0008] The method comprises: determining the data transmission mode according to the type of data; wherein the type of data comprises: structured data, unstructured data, and real-time task data.

[0009] Wherein, the type of the data is structured data;

[0010] When the intranet and the extranet exchange structured data, standardized SQL statements are used to add, delete, modify and query the data; among them, the structured data is stored in a relational database with a clear pattern and structure.

[0011] Wherein, the type of the data is unstructured data; and the method further comprises: when the intranet and the extranet exchange unstructured data:

[0012] If the amount of unstructured data is less than the preset value, the unstructured data is stored in the database in the form of large fields; the unstructured data is added, deleted, modified and queried through the Java persistence layer framework;

[0013] If the amount of unstructured data is greater than the preset value, the relative position of the data in the server is stored in the relational database; when the external network obtains data from the internal network, the unstructured data is read according to the relative position through the database function; when writing data from the external network to the internal network, a new temporary data table is created in the database and the content is written into the data table; the temporary data table is monitored using database triggers; when the database monitors data changes in the temporary data table, the content is written to the specified location of the server and the location is mounted on the OSS server, thereby realizing the transmission of unstructured data from the external network to the internal network OSS.

[0014] The large field types include: text type, image type, audio type, and video type;

[0015] Wherein, the data type is real-time task data; the method comprises:

[0016] When the external network sends the task information to the intranet application server of the intranet, the intranet database http request mechanism is used; the method includes: creating a new task temporary table and creating a corresponding trigger; when the external network sends the task data to the intranet, inserting data into the task temporary table according to predefined rules through SQL; the task trigger monitors the data changes, calls the custom function, parses the task data, and sends the http request to the corresponding service in the intranet to complete the task issuing command;

[0017] When the intranet sends task information to the server in the extranet, a timed monitoring service is created in the extranet; wherein the timed monitoring service regularly reads the data in the task table; when the task data table changes, the data is parsed to complete the instruction operation; wherein the timed monitoring period of the timed monitoring service is preset.

[0018] The data type is semi-structured data; and the method includes: processing the semi-structured data as structured data or unstructured data according to business requirements.

[0019] The beneficial effects of the above technical solution of the present application are as follows: The above technical solution is based on the SGI-NDS200 security network isolation device developed by the State Grid, and is an implementation method for securely interacting data between the information intranet and the information extranet using only standard SQL statements. The interactive data includes structured data, semi-structured data, unstructured data, and real-time data. Through this implementation method, it is possible to guide system services outside the intranet that rely on the State Grid or have information isolation restrictions to achieve secure information interaction. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is the internal and external network architecture diagram based on the security isolation firewall;

[0021] Figure 2 This is a schematic diagram of the internal and external network data interaction based on the security isolation device in an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to make the technical problems, technical solutions and advantages to be solved by the present application clearer, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0023] In the digital age, big data has become a key element in all aspects of society. Big data is not only huge in quantity, but also diverse in types. Information interaction based on secure isolation gateways also includes a variety of data, including but not limited to structured data, unstructured data, semi-structured data, and data that needs to be transmitted in real time. Efficient and secure data interaction can be achieved simply by relying on standardized SQL statements.

[0024] like Figure 1 As shown, in order to further improve the security and reliability of the information network, the current network architecture adopted by the State Grid Corporation is: the external network application server is connected to the internal network through a security isolation device; the internal network includes an internal network database and an internal network application server, and the internal network data server is connected to the internal network application server and connected to the external network through a security isolation device. In order to improve security, the SQL proxy version of the security isolation device customized and developed by the State Grid Corporation adopts the technical architecture of the interface proxy, replaces the JDBC driver accessed by the client, performs actual database access through the SGI-NDS200 device, and performs deep filtering and comprehensive detection of the access to control the interactive data between the internal and external networks. Therefore, the data of the internal and external networks can only interact by connecting to the virtual database in the isolation network gate and using SQL add, delete, modify and query statements.

[0025] In the embodiments of the present application, Figure 2As shown, a method for data interaction between the intranet and the extranet based on a security isolation device is proposed. In view of the current situation that the security isolation device can only use standard SQL statements, secure interaction of data between the information intranet and the information extranet is achieved. In an embodiment of the present application, the data interacted between the information intranet and the information extranet includes: structured data, semi-structured data, unstructured data, and real-time data. Through the method of the disclosed embodiment, it is possible to guide system services outside the intranet that rely on the national power grid or have information isolation restrictions to achieve secure information interaction. Among them:

[0026] (1) Structured data: Structured data is the most common and easy-to-process type of big data. The characteristic of structured data is that each field has a fixed data type and length, such as integer, floating point number, string, etc. It is usually stored in a relational database, has a clear pattern and structure, and can be easily queried and analyzed. Structured data is stored in a database. For this type of data, standardized SQL statements can be used to add, delete, modify, and query data.

[0027] (2) Unstructured data: Unstructured data is the most complex and diverse type of big data. They have no fixed structure and pattern and usually exist in binary form, such as text, images, audio, video, etc. It is difficult to process them in intranet and intranet interactions. They have no fixed structure and pattern, and unstructured data accounts for the vast majority of big data.

[0028] If the amount of unstructured business data is relatively small, its binary data can be stored in the database in the form of large fields. In this way, you can add, delete, modify and query unstructured data by introducing some Java persistence layer frameworks (such as Mybatis, MybatisPlus) in the same way as structured data. In different database management systems, the support for large fields may vary. Common large field types are:

[0029] Text type (Text): used to store large sections of text content, etc.

[0030] Image type: used to store image files, such as photos, icons, etc., and can store tens to hundreds of KB of data.

[0031] Audio type (Audio): used to store audio files, such as music, recordings, etc., and can store data from hundreds of KB to tens of MB.

[0032] Video type: used to store video files, such as movies, video clips, etc., and can store data ranging from tens of MB to several GB.

[0033] If the unstructured file is too large, although it can be stored in the database, if it is not used correctly, it may consume a lot of memory resources and cause the database performance to deteriorate. Therefore, the relational database only stores the relative position of the file in the server. At present, the mainstream database provides functions that can directly read binary files. When the external network obtains data from the internal network, the database function is used to read the unstructured data according to the relative position. When writing data from the external network to the internal network, a temporary data table can be created in the database and the content can be written into the data table. At the same time, the database trigger is used to monitor the temporary data table. When the database monitors the data changes in the temporary data table, the content is written to the specified location on the server hard disk and the location is mounted on the OSS server, thus realizing the transmission of unstructured data from the external network to the internal network OSS.

[0034] (3) Semi-structured data

[0035] Semi-structured data is between structured data and unstructured data. It has a certain structure and pattern, but does not strictly follow a fixed format. Common semi-structured data includes XML, JSON, log files, etc. The database provides JSON type fields to store JSON data. For other XML files or log files, you can refer to the structured data or unstructured data methods to interact with the data on the internal and external networks according to business needs.

[0036] (4) Real-time task data:

[0037] In some businesses, it is necessary to interact with the task data of the internal and external networks in a timely manner through a secure isolation network. For example, it is necessary to issue tasks from the external network to the services of the internal network, or to send notifications from the internal network to the external network. This can only be done through the virtual database in the network gate to interact with the internal and external networks.

[0038] When the external network sends the task information to the server in the internal network, the database http request mechanism can be used: first, a new task temporary table is created and the corresponding trigger is created. When the external network sends the task data to the internal network, the data is inserted into the task temporary table according to the predefined rules through SQL. The task trigger monitors the data changes, calls the custom function, parses the task data, and sends the http request to the corresponding service in the internal network to complete the task issuance command.

[0039] When the intranet sends task information to the server on the external network, the database cannot send HTTP requests to the external network. Therefore, a timed listening service can be created on the external network. Read the data in the task table regularly to implement the data table monitoring function. When the task data table changes, parse the data and complete the instruction operation. Because the timed listening service reads the data table according to a certain cycle, it may cause a certain task delay. You can set the timed listening cycle according to the urgency of the task to simulate the real-time task sending function.

[0040] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer programs. When the computer program is loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer program may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer program may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (digital subscriber line, DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage medium such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (eg, a floppy disk, a hard disk, a magnetic tape), an optical medium (eg, a high-density digital video disc (DVD)), or a semiconductor medium (eg, a solid state disk (SSD)).

[0041] A person skilled in the art may understand that the various numerical numbers such as first and second involved in the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application, and also indicate the order of precedence.

[0042] At least one in the present application can also be described as one or more, and a plurality can be two, three, four or more, which is not limited in the present application. In the embodiments of the present application, for a technical feature, the technical features in the technical feature are distinguished by "first", "second", "third", "A", "B", "C" and "D", etc., and there is no order of precedence or size between the technical features described by the "first", "second", "third", "A", "B", "C" and "D".

[0043] The corresponding relationships shown in each table in the present application can be configured or predefined. The values ​​of the information in each table are only examples and can be configured as other values, which are not limited by the present application. When configuring the corresponding relationship between the information and each parameter, it is not necessarily required to configure all the corresponding relationships illustrated in each table. For example, in the table in the present application, the corresponding relationships shown in some rows may not be configured. For another example, appropriate deformation adjustments can be made based on the above table, such as splitting, merging, etc. The names of the parameters shown in the titles of the above tables can also use other names that can be understood by the communication device, and the values ​​or representations of the parameters can also be other values ​​or representations that can be understood by the communication device. When implementing the above tables, other data structures can also be used, such as arrays, queues, containers, stacks, linear lists, pointers, linked lists, trees, graphs, structures, classes, heaps, hash tables or hash tables.

[0044] The predefined in the present application may be understood as defined, predefined, stored, pre-stored, pre-negotiated, pre-configured, solidified, or pre-burned.

[0045] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0046] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0047] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A method for data interaction between an intranet and an extranet, characterized in that: Applicable to a network with a security isolation device, the network includes an external network and an internal network, and the external network and the internal network are connected through the security isolation device that can only use standard SQL statements; The external network includes an external network application server, which is connected to the internal network through a security isolation device; the internal network includes an internal network database and an internal network application server, which is connected to the internal network application server and connected to the external network through a security isolation device; The method comprises: determining the data transmission mode according to the type of data; wherein the type of data comprises: structured data, unstructured data, and real-time task data.

2. The method for exchanging data between internal and external networks according to claim 1, characterized in that: The type of the data is structured data; When the intranet and the extranet exchange structured data, standardized SQL statements are used to add, delete, modify and query the data; among them, the structured data is stored in a relational database with a clear pattern and structure.

3. The method for exchanging data between internal and external networks according to claim 1, characterized in that: The type of the data is unstructured data; the method further comprises: when the intranet and the extranet exchange unstructured data: If the amount of unstructured data is less than the preset value, the unstructured data is stored in the database in the form of large fields; the unstructured data is added, deleted, modified and queried through the Java persistence layer framework; If the amount of unstructured data is greater than the preset value, the relative position of the data in the server is stored in the relational database; when the external network obtains data from the internal network, the unstructured data is read according to the relative position through the database function; when writing data from the external network to the internal network, a new temporary data table is created in the database and the content is written into the data table; the temporary data table is monitored using database triggers; when the database monitors data changes in the temporary data table, the content is written to the specified location of the server and the location is mounted on the OSS server, thereby realizing the transmission of unstructured data from the external network to the internal network OSS.

4. The method for exchanging data between internal and external networks according to claim 3, characterized in that: The large field types include: text type, image type, audio type, and video type.

5. The method for exchanging data between internal and external networks according to claim 1, characterized in that: The data type is real-time task data; The method comprises: When the external network sends the task information to the intranet application server of the intranet, the intranet database http request mechanism is used; the method includes: creating a new task temporary table and creating a corresponding trigger; when the external network sends the task data to the intranet, inserting data into the task temporary table according to predefined rules through SQL; the task trigger monitors the data changes, calls the custom function, parses the task data, and sends the http request to the corresponding service in the intranet to complete the task issuing command; When the intranet sends task information to the server in the extranet, a timed monitoring service is created in the extranet; wherein the timed monitoring service regularly reads the data in the task table; when the task data table changes, the data is parsed to complete the instruction operation; wherein the timed monitoring period of the timed monitoring service is preset.

6. The method for data interaction between internal and external networks according to claim 1, characterized in that: The data type is semi-structured data; the method comprises: processing the semi-structured data as structured data or unstructured data according to business requirements.

Images