Data interaction system and method based on cross-network interconnection

Abstract

The invention discloses a data interaction system and method based on cross-network interconnection, the system comprises an extranet service system, an internetwork switching device and an intranet service system, the extranet service system transmits to-be-transmitted data to the intranet service system through the internetwork switching device, the internetwork switching device is used for managing a cross-network control strategy, and the intranet service system transmits the to-be-transmitted data to the intranet service system through the internetwork switching device. Detecting the state of inter-network interaction agent equipment, and actively establishing a cross-network data transmission encryption channel; the internetwork switching equipment comprises an extranet processing unit, a switching processing unit and an intranet processing unit; the extranet processing unit is used for processing data transmitted by the extranet service system; the exchange processing unit is used for transmitting the data processed by the external network processing unit to the internal network processing unit; and the intranet processing unit is used for processing the received data and transmitting the processed data to an intranet service system. According to the invention, the data transmission bandwidth and link security can be improved, and the integrity of cross-network transmission data is ensured.

Description

Technical Field

[0001] The present invention belongs to the field of network communication technology, and in particular, relates to a data interaction system and method based on cross-network interconnection. Background Art

[0002] As the level of informatization and data construction increases, cross-network and cross-system data interaction and integration scenarios continue to increase, and the demand for data interaction becomes more and more urgent. As the demand for data interconnection and interoperability across networks becomes more and more frequent, for intranet environments with confidentiality requirements, if they are connected to the external network, they will face various cross-network connection threats from the public network.

[0003] The traditional cross-network security isolation method adopts the "physical isolation" method, using the overall network isolation solution of network gates or optical gates. Both of them only isolate and block the internal and external network interfaces during the cross-network data interaction process, but due to the bandwidth and efficiency limitations of network gates and optical gates, the speed and quality of cross-network data interaction will be affected. In a relatively large and complex intranet environment, the data transmission link is long and there are many data leakage risk points. The "physical isolation" method of network gates or optical gates cannot fully guarantee the security of intranet data transmission; at the same time, when data is exchanged through network gates or optical gates, it is impossible to establish a highly reliable data quality transmission mechanism through the protocol layer, and it is impossible to guarantee the integrity of data during transmission. Summary of the invention

[0004] In view of the problems existing in the prior art, the present invention provides a data interaction system and method based on cross-network interconnection, which improves data transmission bandwidth and link security and ensures the integrity of cross-network transmission data.

[0005] To achieve the above technical objectives, the present invention adopts the following technical solutions: a data interaction system based on cross-network interconnection, including: an external network service system, an inter-network switching device and an intranet service system, the external network service system transmits the data to be transmitted to the intranet service system through the inter-network switching device, the inter-network switching device is used to manage the cross-network control strategy, detect the status of the inter-network interaction proxy device, and actively establish an encrypted channel for cross-network data transmission; the inter-network switching device includes: an external network processing unit, an exchange processing unit and an intranet processing unit, the external network processing unit is used to process the data transmitted from the external network service system; the exchange processing unit is used to transmit the data processed by the external network processing unit to the intranet processing unit; the intranet processing unit is used to process the received data and transmit the processed data to the intranet service system.

[0006] Furthermore, the external network processing unit includes: an external network interface area, a first processing control area and a first data buffer; the external network interface area is used to receive data sent by the external network service system and transmit it to the first processing control area; the first processing control area receives the data sent by the external network interface area, performs a security check on the received data, and stores the data that passes the security check in the first data buffer; the first data buffer sends the stored data one by one to the inter-network switching device.

[0007] Furthermore, the intranet processing unit includes: an intranet interface area, a second processing control area and a second data buffer, the second data buffer receives data from the inter-network switching device, and sends the received data to the second processing control area one by one; the second processing control area performs a data feature security and compliance check on the received data, and sends it to the intranet interface area after the check passes; the intranet interface area sends the received data to the intranet service system.

[0008] Furthermore, the switching processing unit is composed of a light emitting unit and a light receiving unit, and the light emitting unit and the light receiving unit are connected via an optical fiber in an irreversible direction.

[0009] Furthermore, the external network service system includes: an external network data processing service module, a file service module, a push service module and a first network interaction proxy device, the external network data processing service module converts the format of the data to be transmitted into a text file; the file service module is used for temporary storage of text files; the push service module is used to read the text file in the file service module, convert it into a UDP protocol data packet, disassemble and mark the UDP protocol data packet, and send it to the first network interaction proxy device; the first network interaction proxy device is used to passively establish an encrypted channel for cross-network data transmission based on the interaction request between the internal and external networks.

[0010] Furthermore, the intranet service system includes: a second inter-network interaction proxy device, a receiving service module and an intranet data processing service module, wherein the second inter-network interaction proxy device is used to passively establish an encrypted cross-network data transmission channel based on interaction requests between the internal and external networks; the receiving service module is used to receive UDP protocol data packets sent by the second inter-network interaction proxy device, and assemble them in sequence according to the marks on the UDP protocol data packets; the intranet data processing service module is used to receive the UDP protocol data packets assembled by the receiving service module, and perform persistent storage operations.

[0011] Furthermore, the data to be transferred includes: static library table data, dynamic stream data and real-time message data.

[0012] Furthermore, the present invention also provides a data interaction method of the data interaction system based on cross-network interconnection, which specifically comprises the following steps:

[0013] Step 1: convert the data to be transmitted into a text file through the external network data processing module, store the text file in the file service module, and encrypt the text file to generate a check value;

[0014] Step 2: convert the text file and the corresponding check value into a UDP protocol data packet through the push service module, and disassemble and mark the UDP protocol data packet and transmit it to the first inter-network interaction proxy service device;

[0015] Step 3: The first inter-network interaction proxy service device checks the network route and the content of the UDP protocol data packet. If the destination address of the UDP protocol data packet is an intra-network address, the first inter-network interaction proxy service device transmits the data in a transparent transmission mode; otherwise, the inter-network exchange device checks whether the second inter-network interaction proxy service device corresponding to the target address is online. If not, the data transmission is terminated; otherwise, the inter-network exchange device first establishes a data encryption transmission channel with the first inter-network interaction proxy service device, and then establishes a data encryption transmission channel with the second inter-network interaction proxy service device;

[0016] Step 4: After the data encryption transmission channel is established, the UDP protocol data packet is sent to the receiving service module at the destination address through the second inter-network interaction proxy service device;

[0017] Step 5. The receiving service module assembles the packets in sequence according to the marks on the UDP protocol packets and verifies them according to the check values. The UDP protocol packets that fail the verification are placed in the isolation area for future reference. The UDP protocol packets that pass the verification are forwarded to the intranet data processing service module for persistent storage operations.

[0018] Compared with the prior art, the present invention has the following beneficial effects: the data interaction system and method based on cross-network interconnection of the present invention optimizes the inter-network switching equipment and uses irreversible direction optical fiber on the inter-network switching equipment, which can improve the bandwidth of data during cross-network transmission, and establishes a data transmission encryption channel between the inter-network interaction proxy equipment and the inter-network switching equipment, which can improve the link security of data during cross-network transmission; in addition, the present invention adds data verification in the receiving service module of the intranet to ensure the integrity of the data transmitted across the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a framework diagram of the data interaction system based on cross-network interconnection of the present invention;

[0020] Figure 2 A schematic diagram of an inter-network switching device in the present invention;

[0021] Figure 3 It is a schematic diagram of the data interaction method based on cross-network interconnection of the present invention. DETAILED DESCRIPTION

[0022] The technical solution of the present invention is further explained below in conjunction with the accompanying drawings.

[0023] like Figure 1 The framework diagram of the data interaction system based on cross-network interconnection of the present invention includes: an external network service system, an inter-network switching device and an intranet service system. The external network service system transmits the data to be transmitted to the intranet service system through the inter-network switching device. The data to be transmitted in the present invention includes: static library table data, dynamic stream data and real-time message data. The inter-network switching device is used to manage the cross-network control strategy, detect the status of the inter-network interaction proxy device, and actively establish an encrypted channel for cross-network data transmission; Figure 2 The inter-network exchange device includes: an external network processing unit, an exchange processing unit and an internal network processing unit. The external network processing unit is used to process the data transmitted from the external network service system; the exchange processing unit is used to transmit the data processed by the external network processing unit to the internal network processing unit; the internal network processing unit is used to process the received data and transmit the processed data to the internal network service system. Through the data interaction system based on cross-network interconnection of the present invention, the data to be transmitted can be transmitted from the external network service system to the internal network service system, and the integrity and security of the data transmission process can be guaranteed.

[0024] The external network processing unit in the present invention includes: an external network interface area, a first processing control area and a first data buffer; the external network interface area is used to receive data sent by the external network service system and transmit it to the first processing control area; the first processing control area receives the data sent by the external network interface area, and performs virus sample detection, intrusion detection and protection and other security checks on the received data to avoid security holes in the data to be transmitted, ensure the security of data transmission, and then store the data that passes the security check in the first data buffer; the first data buffer sends the stored data one by one to the network switching device.

[0025] The intranet processing unit in the present invention includes: an intranet interface area, a second processing control area and a second data buffer. The second data buffer receives data from an inter-network switching device and sends the received data to the second processing control area one by one; the second processing control area performs virus and intrusion detection security checks on the received data based on data characteristics, and sends pure and compliant data that passes the check to the intranet interface area; the intranet interface area sends the received data to the intranet service system.

[0026] The switching processing unit in the present invention is composed of a light-emitting unit and a light-receiving unit, which are connected by an irreversible optical fiber, which can not only ensure the bandwidth of the data transmission channel, but also physically realize the unidirectional transmission of data in the channel, thereby achieving the physical isolation effect of the network switch.

[0027] The external network service system includes: an external network data processing service module, a file service module, a push service module and a first network interaction proxy device. The external network data processing service module converts the format of the data to be transmitted into a text file; the file service module is used for temporary storage of text files; the push service module is used to read the text file in the file service module, convert it into a UDP protocol data packet, disassemble and mark the UDP protocol data packet, and send it to the first network interaction proxy device; the first network interaction proxy device is used to passively establish an encrypted cross-network data transmission channel according to the interaction request between the internal and external networks. The first network interaction proxy device is located between the external network system and the network switching device, and an encrypted data transmission channel is established between the first network interaction proxy device and the network switching device to ensure that in a complex multi-user network, even if the network traffic is mirrored during data transmission, the business cannot obtain the data content, thereby ensuring that the data is not intercepted, stolen or tampered with during the transmission process, thereby ensuring the integrity of the transmitted data.

[0028] The intranet service system includes: a second inter-network interaction proxy device, a receiving service module and an intranet data processing service module. The second inter-network interaction proxy device is used to passively establish an encrypted cross-network data transmission channel based on the interaction request between the internal and external networks. The second inter-network interaction proxy device is located between the inter-network switching device and the intranet system, and an encrypted data transmission channel is established between the second inter-network interaction proxy device and the inter-network switching device; the receiving service module is used to receive the UDP protocol data packets sent by the second inter-network interaction proxy device, and assemble them in sequence according to the marks on the UDP protocol data packets; the intranet data processing service module is used to receive the UDP protocol data packets assembled by the receiving service module, and perform persistent storage operations.

[0029] like Figure 3 The present invention also provides a data interaction method based on cross-network interconnection, which specifically includes the following steps:

[0030] Step 1: convert the data to be transmitted into a text file through the external network data processing module, store the text file in the file service module, and encrypt the text file through the MD5 encryption algorithm to generate a check value;

[0031] Step 2: convert the text file and the corresponding checksum value into a UDP protocol data packet through the push service module, and disassemble and mark the UDP protocol data packet. Specifically, the UDP protocol data packet is cut into multiple UDP protocol data packets not larger than 64K, and the cut UDP protocol data packets are marked with sequence numbers and transmitted to the first inter-network interaction proxy service device;

[0032] Step 3, the first inter-network interaction proxy service device checks the network route and the content of the UDP protocol data packet. If the destination address of the UDP protocol data packet is an intra-network address, the first inter-network interaction proxy service device transmits the data in a transparent transmission mode; otherwise, the inter-network exchange device checks whether the second inter-network interaction proxy service device corresponding to the target address is online. If not, the data transmission is terminated; otherwise, the inter-network exchange device first establishes a data encryption transmission channel with the first inter-network interaction proxy service device, and then establishes a data encryption transmission channel with the second inter-network interaction proxy service device. The established encrypted transmission channel supports 3GE bandwidth;

[0033] Step 4, after the data encryption transmission channel is established, the UDP protocol data packet is received by the external network interface area in the external network processing unit of the inter-network switching device, and then the UDP protocol data packet is transferred to the first processing control area for security inspection. After the inspection is passed, it is stored in the first data buffer waiting to be sent. The UDP protocol data packets in the first data buffer are sent one by one to the light-emitting unit of the switching processing unit, and sent to the light-receiving unit through the irreversible optical fiber physical line. The light-receiving unit sends the UDP protocol data packet to the second data buffer in the intranet processing unit, and then forwards it to the second processing control area one by one for data feature security compliance inspection. After the inspection is passed, it is handed over to the intranet interface area, and the data is passed to the receiving service module at the destination address through the second inter-network interactive service device;

[0034] Step 5. The receiving service module assembles the data in sequence according to the mark on the UDP protocol data packet, restores the data, and verifies it according to the check value to ensure that the received original data is complete, accurate, and has not been tampered with. The UDP protocol data packet that fails the verification is placed in the isolation area for standby, and is checked for manual confirmation for subsequent retransmission and other operations. The UDP protocol data packet that succeeds the verification is forwarded to the intranet data processing service module for persistent storage operations and stored in the local file server and database, which ensures the integrity of data transmission and the protection of data content from tampering.

[0035] The data interaction system and method based on cross-network interconnection of the present invention can improve the bandwidth of data during cross-network transmission by optimizing the inter-network switching equipment and using irreversible direction optical fiber on the inter-network switching equipment, and can improve the link security of data during cross-network transmission by establishing a data transmission encryption channel between the inter-network interaction proxy equipment and the inter-network switching equipment; in addition, the present invention adds data verification in the receiving service module of the intranet to ensure the integrity of the data transmitted across the network.

[0036] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A data interaction system based on cross-network interconnection, characterized in that: include: An external network service system, an inter-network switching device and an internal network service system, wherein the external network service system transmits the data to be transmitted to the internal network service system through the inter-network switching device, and the inter-network switching device is used to manage the cross-network control strategy, detect the status of the inter-network interaction proxy device, and actively establish an encrypted channel for cross-network data transmission; The inter-network switching device includes: an external network processing unit, a switching processing unit and an internal network processing unit, wherein the external network processing unit is used to process the data transmitted from the external network service system; The exchange processing unit is used to transmit the data processed by the external network processing unit to the internal network processing unit; the internal network processing unit is used to process the received data and transmit the processed data to the internal network service system.

2. A data interaction system based on cross-network interconnection according to claim 1, characterized in that: The external network processing unit includes: an external network interface area, a first processing control area and a first data buffer; the external network interface area is used to receive data sent by the external network service system and transmit it to the first processing control area; the first processing control area receives the data sent by the external network interface area, performs a security check on the received data, and stores the data that passes the security check in the first data buffer; the first data buffer sends the stored data one by one to the inter-network switching device.

3. A data interaction system based on cross-network interconnection according to claim 2, characterized in that: The intranet processing unit includes: an intranet interface area, a second processing control area and a second data buffer, the second data buffer receives data from the inter-network switching device, and sends the received data to the second processing control area one by one; the second processing control area performs a data feature security and compliance check on the received data, and sends it to the intranet interface area after the check passes; the intranet interface area sends the received data to the intranet service system.

4. A data interaction system based on cross-network interconnection according to claim 3, characterized in that: The switching processing unit is composed of a light emitting unit and a light receiving unit, and the light emitting unit and the light receiving unit are connected via an irreversible optical fiber.

5. The data interaction system based on cross-network interconnection according to claim 1 is characterized in that: The external network service system includes: an external network data processing service module, a file service module, a push service module and a first network interaction proxy device. The external network data processing service module converts the format of the data to be transmitted into a text file; the file service module is used for temporary storage of text files; the push service module is used to read the text file in the file service module, convert it into a UDP protocol data packet, disassemble and mark the UDP protocol data packet, and send it to the first network interaction proxy device; the first network interaction proxy device is used to passively establish an encrypted channel for cross-network data transmission based on the interaction request between the internal and external networks.

6. A data interaction system based on cross-network interconnection according to claim 5, characterized in that: The intranet service system includes: a second inter-network interaction proxy device, a receiving service module and an intranet data processing service module, wherein the second inter-network interaction proxy device is used to passively establish an encrypted channel for cross-network data transmission based on interaction requests between the internal and external networks; the receiving service module is used to receive UDP protocol data packets sent by the second inter-network interaction proxy device, and assemble them in sequence according to the marks on the UDP protocol data packets; the intranet data processing service module is used to receive the UDP protocol data packets assembled by the receiving service module, and perform persistent storage operations.

7. The data interaction system based on cross-network interconnection according to claim 1 is characterized in that: The data to be transferred includes: static library table data, dynamic stream data and real-time message data.

8. A data interaction method based on a cross-network interconnection data interaction system according to any one of claims 1 to 7, characterized in that: The specific steps include: Step 1: convert the data to be transmitted into a text file through the external network data processing module, store the text file in the file service module, and encrypt the text file to generate a check value; Step 2: convert the text file and the corresponding check value into a UDP protocol data packet through the push service module, and disassemble and mark the UDP protocol data packet and transmit it to the first inter-network interaction proxy service device; Step 3: The first inter-network interactive proxy service device checks the network route and the content of the UDP protocol data packet. If the destination address of the UDP protocol data packet is an intra-network address, the first inter-network interactive proxy service device transmits the data in a transparent transmission mode. Otherwise, the inter-network interactive proxy service device checks whether the second inter-network interactive proxy service device corresponding to the target address is online through the inter-network switching device. If not, the data transmission is terminated. Otherwise, the network switching device first establishes a data encryption transmission channel with the first network interaction proxy service device, and then establishes a data encryption transmission channel with the second network interaction proxy service device; Step 4: After the data encryption transmission channel is established, the UDP protocol data packet is sent to the receiving service module at the destination address through the second inter-network interaction proxy service device; Step 5. The receiving service module assembles the packets in sequence according to the marks on the UDP protocol packets and verifies them according to the check values. The UDP protocol packets that fail the verification are placed in the isolation area for future reference. The UDP protocol packets that pass the verification are forwarded to the intranet data processing service module for persistent storage operations.

Images