Data interaction method and related device

Abstract

The invention relates to the technical field of data security interaction, and discloses a data interaction method and a related device, which are applied to data isolation equipment, the data isolation equipment comprises a plurality of network ports, a first network port is controlled to be in an open state, and other network ports except the first network port are controlled to be in a closed state. And physical isolation between the first equipment associated with the first network port and equipment associated with other network ports is ensured. A data request message sent by a first device is received through a first network port, after a first communication protocol carried by the data request message is stripped, a second communication protocol corresponding to a second device receiving the data request message is added, and then the first network port is controlled to be in a closed state. And after a second network port corresponding to the second equipment is controlled to be in an open state, the second network port is utilized to send a data request message carrying a second communication protocol to the second equipment, and the purposes of physical isolation and data security interaction between the first equipment and the second equipment are completed.

Description

Background Art

[0002] With the in-depth development of informatization and the increasing popularity of computer network applications, various network attacks and network viruses emerge in an endless stream. Important data of some institutions and enterprises are often stored inside computers. If the computer is not connected to the Internet, using only the intranet can indeed prevent attacks from external networks, but the use process is very inconvenient. If the computer is connected to the Internet, it is easy to cause the leakage of important information when it is attacked. Therefore, it is necessary to add an isolation device between the external network and the internal network of the computer to ensure that data can be exchanged securely between the external network and the internal network.

[0003] Usually, firewalls are used as isolation devices, but this does not completely disconnect the network layer connections such as Transmission Control Protocol (TCP) / Internet Protocol (IP) between the external network and the internal network, and it is still possible to be attacked by TCP / IP network, resulting in data not being exchanged securely. Once the firewall is breached, the secure exchange of data between the internal and external networks cannot be guaranteed. Summary of the invention

[0004] The embodiments of the present application provide a data interaction method and related apparatus, thereby ensuring secure data interaction between multiple devices by physically isolating a first device from a second device.

[0005] In a first aspect, an embodiment of the present application provides a method for data interaction, which is applied to a data isolation device, wherein the data isolation device includes a plurality of network ports, each of which is used for network communication with a device associated with the network port; the method includes:

[0006] Controlling a first network port to be in an open state, and controlling other network ports except the first network port to be in a closed state; the first network port is any one of the multiple network ports;

[0007] receiving, through the first network port, a data request message sent by a first device associated with the first network port, stripping off a first communication protocol carried by the data request message, and adding a second communication protocol corresponding to a second device receiving the data request message;

[0008] Controlling the first network port to be in a closed state, and controlling the second network port corresponding to the second device to be in an open state;

[0009] A data request message carrying the second communication protocol is sent to the second device through the second network port.

[0010] Compared with the prior art, the present application controls any one of the multiple network ports to be in an open state, and controls the other network ports in the multiple network ports to be in a closed state, so as to ensure that during the data interaction between the device associated with the network port and the data isolation device, the devices associated with other network ports are in a physically isolated state, thereby achieving the purpose of physical isolation between the devices associated with the multiple network ports. At the same time, after the first device associated with the first network port sends a data request message to the data isolation device, the first communication protocol carried by the data request message is stripped, and the second communication protocol corresponding to the second device receiving the data request message is added, so as to avoid the inability to exchange data safely due to a communication protocol network attack during the data interaction process.

[0011] In a possible embodiment, before controlling the first network port to be in an open state and controlling other network ports except the first network port to be in a closed state, the method further includes:

[0012] Receive an identity authentication success message sent by the security management center; wherein the identity authentication success message is generated by the security management center after receiving the identity authentication request message sent by the first device and verifying it.

[0013] The present application sets up a method of using a security management center to authenticate the identity of a first device, and after receiving an identity authentication pass message sent by the security management center, a first device associated with a first network port among multiple network ports is physically isolated from devices associated with other network ports to ensure the security of data request messages sent by the first device, and to ensure that the first device and the data isolation device can interact with each other securely.

[0014] In a possible embodiment, adding a second communication protocol corresponding to a second device that receives a data request message includes:

[0015] Parse the data request message to obtain the target IP address in the data request message;

[0016] Determine a second device corresponding to the target IP address based on a preset first correspondence between the device and the IP address, and determine a second communication protocol corresponding to the second device based on a preset second correspondence between the device and the communication protocol;

[0017] Add a second communication protocol to the data request message.

[0018] The present application pre-sets the first corresponding relationship and the second corresponding relationship, thereby accurately determining the second communication protocol, so that the data request message carrying the second communication protocol can be accurately sent to the second device.

[0019] In a possible embodiment, sending a data request message carrying a second communication protocol to a second device through a second network port includes:

[0020] After determining the integrity and / or security of the data request message based on the data application requirements of the second device, the data request message carrying the second communication protocol is sent to the second device through the second network port.

[0021] Before sending a data request message carrying a second communication protocol to a second device, the present application is configured to verify the integrity and / or security of the data request message, for example, verifying whether the data request message has anti-virus functions and malicious codes, so as to ensure secure data interaction between the second device and the data isolation device.

[0022] In a possible embodiment, after sending the data request message carrying the second communication protocol to the second device through the second network port, the method further includes:

[0023] Control the second network port to be in a closed state.

[0024] The present application controls any one of the multiple network ports to be in an open state, and controls the other network ports in the multiple network ports to be in a closed state, so as to ensure that during the data interaction between the device associated with the network port and the data isolation device, the devices associated with other network ports are in a physically isolated state, thereby achieving the purpose of physical isolation between the devices associated with the multiple network ports. Furthermore, after the second device completes the data interaction with the data isolation device, the second network port is controlled to be in a closed state, so as to physically isolate the second device from other devices in a timely manner, thereby ensuring the security of the data stored in the second device.

[0025] In a possible embodiment, the first device is a front-end application device, and the second device is a data server; or,

[0026] The first device is a data server, and the second device is a front-end application device.

[0027] The present application ensures that the first device and the second device can achieve data security interaction through a data isolation device by setting different device attributes for the first device and the second device.

[0028] In a second aspect, an embodiment of the present application provides a data interaction device, which is applied to a data isolation device, wherein the data isolation device includes a plurality of network ports, each of which is used to perform network communication with a device associated with the network port; the device includes:

[0029] A first control module, used to control the first network port to be in an open state, and control other network ports except the first network port to be in a closed state; the first network port is any one of the multiple network ports;

[0030] A communication protocol module, configured to receive, through the first network port, a data request message sent by a first device associated with the first network port, strip the first communication protocol carried by the data request message, and add a second communication protocol corresponding to a second device receiving the data request message;

[0031] A second control module, used to control the first network port to be in a closed state, and control the second network port corresponding to the second device to be in an open state;

[0032] The data sending module is used to send a data request message carrying a second communication protocol to a second device through a second network port.

[0033] In a possible embodiment, the first control module is further used for:

[0034] Receive an identity authentication success message sent by the security management center; wherein the identity authentication success message is generated by the security management center after receiving the identity authentication request message sent by the first device and verifying it.

[0035] In a possible embodiment, the communication protocol module is specifically used for:

[0036] Parse the data request message to obtain the target IP address in the data request message;

[0037] Determine a second device corresponding to the target IP address based on a preset first correspondence between the device and the IP address, and determine a second communication protocol corresponding to the second device based on a preset second correspondence between the device and the communication protocol;

[0038] A second communication protocol is added to the data request message.

[0039] In a possible embodiment, the data sending module is specifically used for:

[0040] After determining the integrity and / or security of the data request message based on the data application requirements of the second device, the data request message carrying the second communication protocol is sent to the second device through the second network port.

[0041] In a possible embodiment, the data sending module is further used for:

[0042] Control the second network port to be in a closed state.

[0043] In a possible embodiment, the first device is a front-end application device, and the second device is a data server; or,

[0044] The first device is a data server, and the second device is a front-end application device.

[0045] In a third aspect, an embodiment of the present application provides a data isolation device, the device comprising:

[0046] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can perform the data interaction method as described in any one of the first aspects.

[0047] In a fourth aspect, an embodiment of the present application provides a computer storage medium, wherein the computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the data interaction method as described in any one of the first aspects.

[0048] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the method for data interaction as described in any one of the first aspects.

[0049] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. Obviously, the drawings introduced below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0051] Figure 1 A schematic diagram of an application scenario of a data interaction method provided in an embodiment of the present application;

[0052] Figure 2 A flowchart of a data interaction method provided in one embodiment of the present application;

[0053] Figure 3 A flowchart of a data interaction method provided in one embodiment of the present application;

[0054] Figure 4 A schematic diagram of a data interaction device structure provided in one embodiment of the present application;

[0055] Figure 5 A schematic diagram of a data isolation device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to enable ordinary persons in the art to better understand the technical solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0057] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here can be implemented in an order other than those illustrated or described here. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. On the contrary, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0058] With the in-depth development of informatization and the increasing popularity of computer network applications, various network attacks and network viruses emerge in an endless stream. Important data of some institutions and enterprises are often stored inside computers. If the computer is not connected to the Internet, using only the intranet can indeed prevent attacks from external networks, but the use process is very inconvenient. If the computer is connected to the Internet, it is easy to cause the leakage of important information when it is attacked. Therefore, it is necessary to add an isolation device between the external network and the internal network of the computer to ensure that data can be exchanged securely between the external network and the internal network.

[0059] Usually, the isolation device uses a firewall, but this does not completely disconnect the TCP / IP and other network layer connections between the external network and the internal network, and it may still be attacked by TCP / IP network, resulting in data not being exchanged safely. And once the firewall is breached, the secure exchange of data between the internal and external networks cannot be guaranteed.

[0060] To this end, the present application provides a method and related device for data interaction, by controlling any one of the multiple network ports to be in an open state, and controlling the other network ports in the multiple network ports to be in a closed state, it can be ensured that during the data interaction between the device associated with the network port and the data isolation device, the devices associated with other network ports are in a physically isolated state, thereby achieving the purpose of physical isolation between the devices associated with the multiple network ports. At the same time, after the first device associated with the first network port sends a data request message to the data isolation device, the first communication protocol carried by the data request message is stripped, and the second communication protocol corresponding to the second device receiving the data request message is added, so as to avoid the inability to exchange data safely due to a communication protocol network attack during the data interaction process.

[0061] After introducing the design ideas of the embodiments of the present application, the following briefly introduces the application scenarios to which the technical solutions of the embodiments of the present application can be applied. It should be noted that the application scenarios introduced below are only used to illustrate the embodiments of the present application and are not limited. In specific implementation, the technical solutions provided by the embodiments of the present application can be flexibly applied according to actual needs.

[0062] refer to Figure 1 , which is a schematic diagram of an application scenario of the method for data interaction provided in an embodiment of the present application. The application scenario includes: a first device 101, a data isolation device 102, a second device 103, an agent center 104, and a security management center 105. The data isolation device 102 may include: a first network port 102-1 and a second network port 102-2. Among them, the security management center 105 and the agent center 104 may be located in the user space, and the first device 101, the data isolation device 102, and the second device 103 may be located in the kernel space. The initial state of the first network port 102-1 and the second network port 102-2 may both be in a closed state.

[0063] The first device 101 sends an identity authentication request message to the security management center 105. The security management center 105 performs identity authentication on the first device 101 according to the identity authentication request message, and after the identity authentication is passed, sends an identity authentication pass message to the data isolation device 102 through the proxy center 104. After receiving the identity authentication pass message of the first device 101, the data isolation device 102 can control the first network port 102-1 to be in an open state and the second network port 102-2 to be in a closed state, so as to physically isolate the first device 101 and the second device 103, and the first device 101 and the data isolation device 102 perform data security interaction.

[0064] Optionally, the data isolation device 102 receives the data request message sent by the first device 101 through the first network port 102-1, strips the first communication protocol carried by the data request message, and then adds the second communication protocol corresponding to the second device to the data request message. Here, after the first device 101 sends the data request message to the data isolation device 102, the data isolation device 102 can control the first network port 102-1 to be in a closed state. At this time, the data isolation device 102 can also control the second network port 102-2 to be in an open state, and then the data isolation device 102 sends the data request message with the second communication protocol added to the second device 103.

[0065] Exemplarily, the data isolation device 102 may be located on a network packet processing framework (eXpressData Path, XDP) in the kernel space to ensure that the data interaction process generates low additional overhead. The data isolation device 102 may also establish a sockets communication protocol connection with the second device 103 through a network stack. The network stack may also include a transmission direction for a data packet to leave a network device and a transmission direction for a data packet to enter a network device.

[0066] It should be known that the present application can adapt the data isolation device 102 to the cloud environment through the proxy center 104 , so that the first device 101 and the second device 103 can perform distributed management of data interaction through the data isolation device 102 .

[0067] Of course, the method provided in the embodiment of the present application is not limited to Figure 1 The application scenario shown can also be used in other possible application scenarios.

[0068] To further illustrate the technical solution provided by the embodiment of the present application, this is described in detail below in conjunction with the accompanying drawings and specific implementation methods. Although the embodiment of the present application provides the method operation steps shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative labor. In the steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided by the embodiment of the present application.

[0069] Combine the following Figure 1 The application scenario shown illustrates the technical solution provided by the embodiment of the present application.

[0070] like Figure 2 As shown, an embodiment of the present application discloses a flow chart of a method for data interaction, which is applied to a data isolation device, wherein the data isolation device includes a plurality of network ports, each of which is used for network communication with a device associated with the network port, and the method includes the following steps:

[0071] S201, controlling a first network port to be in an open state, and controlling other network ports except the first network port to be in a closed state; the first network port is any one of the multiple network ports.

[0072] Exemplarily, before controlling the opening or closing of multiple network ports, in order to ensure the security of the first device associated with the first network port in the open state sending a data request message to the data isolation device, the first device can be authenticated by the security management center.

[0073] Optionally, the first device sends an identity authentication request message to the security management center, and the security management center performs identity authentication on the first device according to the identity authentication request message, and after the authentication is successful, sends an identity authentication success message of the first device to the data isolation device.

[0074] After the data isolation device controls the opening or closing status of multiple network ports, continue to execute step S202, receive the data request message sent by the first device associated with the first network port through the first network port, strip the first communication protocol carried by the data request message, and add the second communication protocol corresponding to the second device that receives the data request message.

[0075] Here, the first device may be a front-end application device, and the second device may be a data server; or the first device may be a data server, and the second device may be a front-end application device. This is only an example, and the present application does not limit the specific device types of the first device and the second device.

[0076] Exemplarily, in order to avoid the inability to safely interact with data due to communication protocol attacks during data interaction, the data isolation device can strip the first communication protocol originally carried by the data request message after receiving the data request message sent by the first device, and add other communication protocols for data interaction.

[0077] Furthermore, by parsing the data request message, the target IP address carried in the data request message can be obtained, and then based on the first correspondence between the preset device and the IP address, the second device corresponding to the target IP address is determined, and based on the second correspondence between the preset device and the communication protocol, the second communication protocol corresponding to the second device is determined, and finally, the second communication protocol is added to the data request message so that the data isolation device and the second device can interact with each other via the data request message carrying the second communication protocol.

[0078] For example, by parsing the data request message, it is found that the target IP address it carries is IP address 1. From the first correspondence shown in Table 1 below, it can be seen that the device corresponding to IP address 1 is the second device, and from the second correspondence shown in Table 2 below, it can be seen that the communication protocol corresponding to the second device is the second communication protocol.

[0079] Table 1

[0080] equipment IP address Second device IP Address 1 Third Equipment IP Address 4 … … nth device IP address M

[0081] Table 2

[0082] equipment Communication Protocol Second device Second communication protocol Third Equipment Fourth communication protocol … … nth device Mth Communication Protocol

[0083] After the data isolation device receives the data request message sent by the first device and performs communication protocol processing on the data request message, in order to ensure data interaction between the data isolation device and the second device, step S203 can be continued to be executed, the first network port can be controlled to be in a closed state, and the second network port corresponding to the second device can be controlled to be in an open state, and step S204 can be executed to send the data request message carrying the second communication protocol to the second device through the second network port.

[0084] In a possible embodiment, after determining the integrity and / or security of the data request message based on the data application requirements of the second device, the data request message carrying the second communication protocol is sent to the second device through the second network port. For example, if the data application requirement of the second device is data integrity, before sending the data request message carrying the second communication protocol to the second device, it is possible to first verify whether the data request message is complete. If the data application requirement of the second device is data security, before sending the data request message carrying the second communication protocol to the second device, it is possible to first verify whether the data request message is anti-virus and whether the data request message contains malicious code.

[0085] In a possible embodiment, after sending a data request message carrying a second communication protocol to a second device through a second network port, the second network port can also be controlled to be in a closed state to ensure physical isolation between the second device and other devices, thereby ensuring data security in the second device.

[0086] like Figure 3 As shown, an embodiment of the present application discloses a flow chart of a method for data interaction, the method comprising the following steps:

[0087] S301, the first device sends an identity authentication request message to the security management center;

[0088] S302, the security management center performs identity authentication on the first device according to the identity authentication request message, and after the authentication is successful, sends a message indicating that the identity authentication of the first device is successful to the data isolation device;

[0089] S303, the data isolation device controls the first network port to be in an open state, and controls other network ports except the first network port to be in a closed state;

[0090] S304, the first device sends a data request message to the data isolation device through the first network port;

[0091] S305, the data isolation device verifies the integrity and / or security of the data request message, strips off the first communication protocol carried by the data request message, and adds a second communication protocol corresponding to the second device receiving the data request message;

[0092] S306, the data isolation device controls the first network port to be in a closed state, and controls the second network port corresponding to the second device to be in an open state;

[0093] S307, the data isolation device sends a non-TCP connection request to the second device;

[0094] S308: The data isolation device sends a data request message carrying the second communication protocol to the second device through the second network port.

[0095] like Figure 4 As shown, an embodiment of the present application discloses a schematic diagram of a data interaction device structure, which is applied to a data isolation device, wherein the data isolation device includes a plurality of network ports, each of which is used for network communication with a device associated with the network port; the device includes:

[0096] A first control module 401 is used to control a first network port to be in an open state, and to control other network ports except the first network port to be in a closed state; the first network port is any one of the multiple network ports;

[0097] The communication protocol module 402 is used to receive, through the first network port, a data request message sent by a first device associated with the first network port, strip the first communication protocol carried by the data request message, and add a second communication protocol corresponding to a second device receiving the data request message;

[0098] The second control module 403 is used to control the first network port to be in a closed state, and control the second network port corresponding to the second device to be in an open state;

[0099] The data sending module 404 is used to send a data request message carrying the second communication protocol to the second device through the second network port.

[0100] In a possible embodiment, the first control module 401 is further configured to:

[0101] Receive an identity authentication success message sent by the security management center; wherein the identity authentication success message is generated by the security management center after receiving the identity authentication request message sent by the first device and verifying it.

[0102] In a possible embodiment, the communication protocol module 402 is specifically used for:

[0103] Parse the data request message to obtain the target IP address in the data request message;

[0104] Determine a second device corresponding to the target IP address based on a preset first correspondence between the device and the IP address, and determine a second communication protocol corresponding to the second device based on a preset second correspondence between the device and the communication protocol;

[0105] A second communication protocol is added to the data request message.

[0106] In a possible embodiment, the data sending module 404 is specifically used for:

[0107] After determining the integrity and / or security of the data request message based on the data application requirements of the second device, the data request message carrying the second communication protocol is sent to the second device through the second network port.

[0108] In a possible embodiment, the data sending module 404 is further configured to:

[0109] Control the second network port to be in a closed state.

[0110] In a possible embodiment, the first device is a front-end application device, and the second device is a data server; or,

[0111] The first device is a data server, and the second device is a front-end application device.

[0112] After introducing the data interaction method and related apparatus according to the exemplary embodiment of the present application, next, a data isolation device according to another exemplary embodiment of the present application is introduced.

[0113] Those skilled in the art will appreciate that various aspects of the present application may be implemented as a system, method or program product. Therefore, various aspects of the present application may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to as "circuit", "module" or "system" herein.

[0114] In some possible implementations, the data isolation device according to the present application may include at least one processor and at least one memory. The memory stores program code, and when the program code is executed by the processor, the processor executes the steps in the method for data interaction according to various exemplary embodiments of the present application described above in this specification. For example, the processor may execute the steps in the method for data interaction.

[0115] Refer to the following Figure 5 The data isolation device 50 according to this embodiment of the present application will be described. Figure 5 The data isolation device 50 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0116] like Figure 5 As shown, the data isolation device 50 is in the form of a general data isolation device. The components of the data isolation device 50 may include but are not limited to: at least one processor 51, at least one memory 52, and a bus 53 connecting different system components (including the memory 52 and the processor 51).

[0117] Bus 53 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor or local bus using any of a variety of bus architectures.

[0118] The memory 52 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 521 and / or a cache memory 522 , and may further include a read-only memory (ROM) 523 .

[0119] The memory 52 may also include a program / utility 525 having a set (at least one) of program modules 524, such program modules 524 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0120] The data isolation device 50 may also communicate with one or more external devices 54 (e.g., keyboards, pointing devices, etc.), may also communicate with one or more devices that enable a user to interact with the data isolation device 50, and / or may communicate with any device that enables the data isolation device 50 to communicate with one or more other data isolation devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 55. Furthermore, the data isolation device 50 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 56. As shown, the network adapter 56 communicates with other modules for the data isolation device 50 via a bus 53. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the data isolation device 50, including but not limited to: microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0121] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory 52 including instructions, and the instructions can be executed by the processor 51 to perform the above method. Alternatively, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0122] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, which implements any of the methods for data interaction provided in the present application when executed by the processor 51 .

[0123] In an exemplary embodiment, various aspects of a method for data interaction provided by the present application may also be implemented in the form of a program product, which includes program code. When the program product is run on a computer device, the program code is used to enable the computer device to execute the steps of a method for data interaction according to various exemplary embodiments of the present application described above in this specification.

[0124] The program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0125] The program product for unlocking a data isolation device of an embodiment of the present application may adopt a portable compact disk read-only memory (CD-ROM) and include program code, and may be run on a data isolation device. However, the program product of the present application is not limited thereto, and in this document, a readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, apparatus, or device.

[0126] A readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, wherein readable program code is carried. Such propagated data signals may take a variety of forms, including, but not limited to, electromagnetic signals, optical signals, or any suitable combination of the foregoing. A readable signal medium may also be any readable medium other than a readable storage medium, which may transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0127] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0128] The program code for performing the operation of the present application can be written in any combination of one or more programming languages, and the programming language includes object-oriented programming languages, such as Java, C++, etc., and also includes conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed completely on the user data isolation device, partially on the user device, as an independent software package, partially on the user data isolation device, partially on the remote data isolation device, or completely on the remote data isolation device or the server. In the case of the remote data isolation device, the remote data isolation device can be connected to the user data isolation device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external data isolation device (e.g., using an Internet service provider to connect through the Internet).

[0129] It should be noted that, although several units or subunits of the device are mentioned in the above detailed description, this division is merely exemplary and not mandatory. In fact, according to the embodiments of the present application, the features and functions of two or more units described above can be embodied in one unit. Conversely, the features and functions of one unit described above can be further divided into multiple units to be embodied.

[0130] In addition, although the operations of the method of the present application are described in a specific order in the drawings, this does not require or imply that the operations must be performed in this specific order, or that all the operations shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0131] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0132] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data isolation device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data isolation device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data isolation device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions may also be loaded onto a computer or other programmable data isolation device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0136] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data interaction method, characterized in that: Applied to a data isolation device, the data isolation device includes a plurality of network ports, each network port is used for network communication with a device associated with the network port; the method includes: Controlling a first network port to be in an open state, and controlling other network ports except the first network port to be in a closed state; the first network port is any one of the multiple network ports; receiving, through the first network port, a data request message sent by a first device associated with the first network port, stripping off a first communication protocol carried by the data request message, and adding a second communication protocol corresponding to a second device receiving the data request message; Controlling the first network port to be in a closed state, and controlling the second network port corresponding to the second device to be in an open state; A data request message carrying the second communication protocol is sent to the second device through the second network port.

2. The method according to claim 1, characterized in that Before controlling the first network port to be in an open state and controlling other network ports except the first network port to be in a closed state, the method further includes: Receive an identity authentication success message sent by a security management center; wherein the identity authentication success message is generated by the security management center after receiving an identity authentication request message sent by the first device and verifying it.

3. The method according to claim 1, characterized in that The adding a second communication protocol corresponding to the second device receiving the data request message includes: Parsing the data request message to obtain a target IP address in the data request message; Determine a second device corresponding to the target IP address based on a preset first correspondence between a device and an IP address, and determine the second communication protocol corresponding to the second device based on a preset second correspondence between a device and a communication protocol; The second communication protocol is added to the data request message.

4. The method according to claim 1, characterized in that: The sending, through the second network port, a data request message carrying the second communication protocol to the second device includes: After determining the integrity and / or security of the data request message based on the data application requirements of the second device, the data request message carrying the second communication protocol is sent to the second device through the second network port.

5. The method according to claim 1, characterized in that After sending the data request message carrying the second communication protocol to the second device through the second network port, the method further includes: Control the second network port to be in a closed state.

6. The method according to claim 1, characterized in that The first device is a front-end application device, and the second device is a data server; or The first device is the data server, and the second device is the front-end application device.

7. A data interaction device, characterized in that: Applied to a data isolation device, the data isolation device comprises a plurality of network ports, each network port is used for network communication with a device associated with the network port; the device comprises: A first control module, used for controlling a first network port to be in an open state, and controlling other network ports except the first network port to be in a closed state; the first network port is any one of the multiple network ports; a communication protocol module, configured to receive, through the first network port, a data request message sent by a first device associated with the first network port, strip the first communication protocol carried by the data request message, and add a second communication protocol corresponding to a second device receiving the data request message; A second control module, used to control the first network port to be in a closed state, and control the second network port corresponding to the second device to be in an open state; A data sending module is used to send a data request message carrying the second communication protocol to the second device through the second network port.

8. The device according to claim 7, characterized in that The data sending module is also used for: Control the second network port to be in a closed state.

9. A data isolation device, characterized in that: The device comprises: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for data interaction as described in any one of claims 1-6.

10. A computer storage medium, characterized in that: The computer storage medium stores a computer program, and the computer program is used to enable a computer to execute the data interaction method according to any one of claims 1 to 6.

Images