Method for realizing cross-network communication based on double unidirectional optical shutters

Abstract

The invention belongs to the field of intelligent integration networks, and particularly relates to a method for realizing cross-network communication based on double one-way optical shutters, which is used for secret communication between two physically isolated networks. Information of an industrial control network is quickly imported into an internal office network, and data in a specific format in the internal office network is safely and controllably exported into the industrial control network; recording a data exchange log and a security log in an internal office network in a unified manner; clock synchronization between two physical isolation networks with different security levels, such as an internal office network system and an industrial control system, is realized, and the time difference in the transmission process of the two networks is solved.

Description

Technical Field

[0001] The present invention belongs to the field of intelligent network integration, and specifically relates to a method for realizing cross-network communication based on dual unidirectional optical gates. Background Art

[0002] In recent years, industrialization and informatization have gradually merged deeply. The research and development and coordination in the equipment production process mainly rely on the internal office network system, while production, experiments and testing are inseparable from the industrial control system. The information islands and information exchange lags between the internal office network and the industrial control network have seriously restricted the improvement of equipment scientific research and production efficiency. Therefore, it is imperative to realize the secure interconnection between the internal office network and the industrial control network, eliminate the bottlenecks in the equipment scientific research and production links, improve production efficiency, and realize the digitalization and intelligence of equipment production.

[0003] By utilizing dual one-way networks / optical gates, secure and controllable real-time data interaction between the internal office network and the industrial control system can be achieved, ensuring that the internal office network data is safely, reliably, controllably and stably sent to the industrial control network. The manufacturing data of the industrial control network is fed back to the internal office network in a timely and rapid manner to adjust and optimize processing parameters, accelerate product finalization and mass production, effectively improve the company's production benefits and overall operational efficiency, and promote the implementation of intelligent manufacturing technology.

[0004] How to safely and quickly transmit data between two physically isolated networks? First, we need to open up a secure data transmission channel between the two networks and follow strict data flow control. Therefore, we need to design two one-way data interaction links. To ensure the readability of data and related logs on both sides, we need to ensure clock synchronization between the two networks. The demand for information sharing and data interaction between different networks is increasing. The traditional manual ferrying method has seriously restricted the speed of industrialization and informatization integration, and also restricted the progress of equipment development and production. Summary of the invention

[0005] In view of this, the present invention provides a method for realizing cross-network communication based on dual one-way optical gates, which can quickly import the information of the industrial control network into the internal office network, and safely and controllably export the data in a specific format in the internal office network to the industrial control network, and uniformly record the data exchange log and security log in the internal office network; realize the clock synchronization between two networks with different levels of physical isolation, such as the internal office network system and the industrial control system, and solve the time difference in the transmission process between the two networks.

[0006] The technical solution of the present invention is:

[0007] A method for realizing cross-network communication based on dual one-way optical gates is used for confidential communication between two physically isolated networks. The method for realizing cross-network communication based on dual one-way optical gates is specifically as follows:

[0008] Setting a clock synchronization source within the two networks based on the network system ntp service;

[0009] The system ntp service sets the information exchange platform in the two networks as the client and the clock source server as the server;

[0010] The information exchange platform front-end periodically initiates a time synchronization request to the information exchange platform back-end through a one-way export device. After receiving the request, the information exchange platform front-end returns the response to the information exchange platform back-end through a one-way import device.

[0011] The transmission path of the time request between the two networks is:

[0012] Information exchange platform is placed at the rear → one-way export device of one-way network or optical gate → information exchange platform is placed at the front → one-way import device of one-way network or optical gate → information exchange platform is placed at the rear.

[0013] Furthermore, the information exchange platform calculates a final time offset offset through the timestamp of a round trip of the time request between the two networks, where offset = (receiving response time - sending request time) / 2.

[0014] Furthermore, if the transmission time of the time request between the two networks is within the set reasonable range, the clock source updates the local time: the client's internal office network clock = the industrial control network synchronization clock - offset; if not, the update is abandoned.

[0015] Furthermore, one-way optical gate devices for both uplink and downlink directions are deployed in the information exchange area between the two networks;

[0016] The independent security domains set on both sides of the one-way optical gate are configured with boundary firewalls; the boundary firewall is used to set an access control policy configured according to the minimum authorization principle between the two networks.

[0017] Furthermore, the border firewall is provided with corresponding permissions for each IP and each port required to be called when the two networks communicate.

[0018] Furthermore, a centralized security management platform is provided in both of the networks;

[0019] The centralized security management platform is used to realize centralized monitoring and unified security policy management of border firewalls, industrial control security monitoring and auditing, and industrial control host protection products in the industrial control network, through security event correlation analysis and security trend risk warning, and analyze and handle abnormal event time and violation events in the exchange process.

[0020] Furthermore, the exchange logs and security log information generated by the two networks during the data exchange process are imported and saved in the security audit system of the internal office network for unified record storage and big data analysis;

[0021] Furthermore, the time update method within the two networks is: based on the NTP protocol, the business application system and the internal office network information exchange platform maintain time synchronization; wherein the business application system is the client and the internal office network information exchange platform is the server.

[0022] Beneficial effects of the present invention:

[0023] The present invention realizes cross-network clock synchronization through dual unidirectional network / optical gates, which not only enables two physically isolated networks to exchange data safely and quickly, but also the two network devices and servers on the industrial control network side work under the same clock, and the consistency, integrity and traceability of the data are greatly improved, laying a foundation for the use of data measured by the industrial control network, and providing safe and efficient operation guarantee for the construction of industrial control systems. The present invention is suitable for the "smart transformation to digital transformation" of the military industry, and the integration demand of IOT is increasing. The clock synchronization between physically isolated different networks has a broad application prospect. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 This is the overall architecture of the two-network interconnection information exchange platform and security protection system for the specific implementation of the present invention;

[0026] Figure 2 A schematic diagram of a time synchronization process in a specific embodiment of the present invention;

[0027] Figure 3 It is a program configuration diagram for a specific implementation mode of the present invention. DETAILED DESCRIPTION

[0028] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0029] The following describes the embodiments of the present disclosure through specific examples, and those skilled in the art can easily understand other advantages and effects of the present disclosure from the contents disclosed in this specification. Obviously, the described embodiments are only a part of the embodiments of the present disclosure, rather than all of the embodiments. The present disclosure can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present disclosure. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present disclosure.

[0030] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein can be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein can be implemented independently of any other aspect, and two or more of these aspects can be combined in various ways. For example, any number of aspects described herein can be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein can be used to implement this device and / or practice this method.

[0031] It should also be noted that the illustrations provided in the following embodiments are only schematic illustrations of the basic concept of the present disclosure. The illustrations only show components related to the present disclosure rather than being drawn according to the number, shape and size of components in actual implementation. In actual implementation, the type, quantity and proportion of each component may be changed arbitrarily, and the component layout may also be more complicated.

[0032] Additionally, in the following description, specific details are provided to facilitate a thorough understanding of the examples. However, it will be understood by those skilled in the art that the aspects described may be practiced without these specific details.

[0033] In one embodiment of the present invention, a method for realizing cross-network communication based on dual one-way optical gates is proposed for secure communication between two physically isolated networks; Figure 1 , 2 As shown, the method for realizing cross-network communication based on dual one-way optical gates is specifically as follows:

[0034] Setting a clock synchronization source within the two networks based on the network system ntp service;

[0035] The system ntp service sets the information exchange platform in the two networks as the client and the clock source server as the server;

[0036] The information exchange platform front-end periodically initiates a time synchronization request to the information exchange platform back-end through a one-way export device. After receiving the request, the information exchange platform front-end returns the response to the information exchange platform back-end through a one-way import device.

[0037] The transmission path of the time request between the two networks is:

[0038] Information exchange platform is placed at the rear → one-way export device of one-way network or optical gate → information exchange platform is placed at the front → one-way import device of one-way network or optical gate → information exchange platform is placed at the rear.

[0039] In this embodiment, the information exchange platform calculates the final time offset offset through the timestamp of a round trip time request between two networks, where offset = (receiving response time - sending request time) / 2.

[0040] In this embodiment, if the transmission time of the time request between the two networks is within a set reasonable range, the clock source updates the local time: the client's internal office network clock = the industrial control network synchronization clock - offset; otherwise, the update is abandoned.

[0041] In this embodiment, one-way optical gate devices for both uplink and downlink directions are deployed in the information exchange area between the two networks;

[0042] The independent security domains set on both sides of the one-way optical gate are configured with boundary firewalls; the boundary firewall is used to set an access control policy configured according to the minimum authorization principle between the two networks.

[0043] In this embodiment, the border firewall is provided with corresponding permissions for each IP and each port that needs to be called when the two networks communicate.

[0044] In this embodiment, a centralized security management platform is provided in both networks;

[0045] The centralized security management platform is used to realize centralized monitoring and unified security policy management of border firewalls, industrial control security monitoring and auditing, and industrial control host protection products in the industrial control network, through security event correlation analysis and security trend risk warning, and analyze and handle abnormal event time and violation events in the exchange process.

[0046] In this embodiment, the exchange logs and security log information generated by the two networks during the data exchange process are imported and saved in the security audit system of the internal office network for unified record storage and big data analysis;

[0047] In this embodiment, the time update method within the two networks is: based on the NTP protocol, the business application system and the internal office network information exchange platform maintain time synchronization; the business application system is the client and the internal office network information exchange platform is the server.

[0048] This embodiment realizes secure data exchange between physically isolated different networks, such as quickly importing information from the industrial control network into the internal office network, exporting data in a specific format in the internal office network to the industrial control network in a secure and controllable manner, and uniformly recording data exchange logs and security logs in the internal office network; it realizes clock synchronization between two networks with different levels of physical isolation, such as the internal office network system and the industrial control system, and solves the time difference in the transmission process between the two networks. In order to ensure the authenticity of the source of information transmission between the two networks, the compliance of the content, the unidirectionality of the process, the traceability and auditability of the data, and the security of the system itself, the clock synchronization of the two networks is guaranteed to solve the time difference problem in the transmission process, and the time difference is guaranteed to be within 1s.

[0049] The specific operation process of this embodiment is as follows:

[0050] Step 1: Open up a secure data transmission channel between the two networks:

[0051] Deploy one-way optical gate devices in both the upstream and downstream directions in the information exchange area between the internal office network and the industrial control network. Use the physical one-way characteristics of the one-way optical gate to ensure that file transmission is absolutely one-way and feedback-free. Configure boundary firewalls in the independent security domains set on both sides of the one-way optical gate to form boundary protection for one-way import transmission channels and one-way export transmission channels. Use the principle of minimum authorization to configure access control policies, and refine them to the IP address and service port level to achieve data flow control. Deploy industrial control centralized security management platform, industrial control security monitoring and auditing, industrial control host protection and other products on the industrial control network side for centralized monitoring and unified management of security policies. The exchange logs and security log information during the exchange between the two networks are uniformly imported and saved in the security audit system of the internal office network for unified record storage and big data analysis.

[0052] Step 2: Synchronize the clocks of the two networks

[0053] 1. Configure the clock source server for the industrial control network side. The NTP service of the industrial control network clock source server is configured as the NTP server. The information exchange platform is configured as the NTP client. The information exchange platform on the other network side is configured as the NTP server. The rest are configured as the NTP client.

[0054] 2. Install the dsep-ntp exchange module on the servers of the information exchange platform front-end and information exchange platform back-end (two networks): Upload the dsep-ntp rpm package → Find the directory where the dsep-ntp installation package is located and cd to the corresponding directory → Execute the installation command rpm-ivh dsep-ntp*.rpm → Execute the command vi / opt / njzf / dsep-ntp / config / application.yml as follows Figure 3 Configuration shown

[0055] 3. Install the system ntp service for all machines: upload ntp*.rpm to the root directory → enter the root directory and execute the installation rpm-ivh ntp*.rpm,

[0056] Configure the client: vi / etc / ntp.config add server{ip}

[0057] Configure the server: vi / etc / ntp.config, add the TTP client network segment that needs to access this machine

[0058] 4. Restart the system ntp service: stemctl restart ntpd

[0059] Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

[0060] The above is only a specific implementation of the present disclosure, but the protection scope of the present disclosure is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed in the present disclosure should be included in the protection scope of the present disclosure. Therefore, the protection scope of the present disclosure should be based on the protection scope of the claims.

Claims

1. A method for realizing cross-network communication based on dual one-way optical gates, characterized in that: Used for confidential communication between two physically isolated networks; the method for realizing cross-network communication based on dual one-way optical gates is specifically as follows: Setting a clock synchronization source within the two networks based on the network system ntp service; The system ntp service sets the information exchange platform in the two networks as the client and the clock source server as the server; The information exchange platform front-end periodically initiates a time synchronization request to the information exchange platform back-end through a one-way export device. After receiving the request, the information exchange platform front-end returns the response to the information exchange platform back-end through a one-way import device. The transmission path of the time request between the two networks is: Information exchange platform is placed at the rear → one-way export device of one-way network or optical gate → information exchange platform is placed at the front → one-way import device of one-way network or optical gate → information exchange platform is placed at the rear.

2. The method for realizing cross-network communication based on dual one-way optical gates according to claim 1, characterized in that: The information exchange platform calculates the final time offset offset through the timestamp of a round trip of the time request between the two networks, where offset = (receiving response time - sending request time) / 2.

3. The method for realizing cross-network communication based on dual one-way optical gates according to claim 2, characterized in that: If the transmission time of the time request between the two networks is within the set reasonable range, the clock source updates the local time: the client's internal office network clock = the industrial control network synchronization clock - offset; if not, the update is abandoned.

4. The method for realizing cross-network communication based on dual one-way optical gates according to claim 3, characterized in that: One-way optical gate devices for both uplink and downlink directions are deployed in the information exchange area between the two networks; The independent security domains set on both sides of the one-way optical gate are configured with boundary firewalls; the boundary firewall is used to set an access control policy configured according to the minimum authorization principle between the two networks.

5. The method for realizing cross-network communication based on dual one-way optical gates according to claim 4, characterized in that: The border firewall is provided with corresponding permissions for each IP and each port that needs to be called when the two networks communicate.

6. The method for realizing cross-network communication based on dual one-way optical gates according to claim 5, characterized in that: A centralized security management platform is provided in both of the networks; The centralized security management platform is used to realize centralized monitoring and unified security policy management of border firewalls, industrial control security monitoring and auditing, and industrial control host protection products in the industrial control network, through security event correlation analysis and security trend risk warning, and analyze and handle abnormal event time and violation events in the exchange process.

7. The method for realizing cross-network communication based on dual one-way optical gates according to claim 6, characterized in that: The exchange logs and security log information generated by the two networks during the data exchange process are imported and saved in the security audit system of the internal office network for unified record storage and big data analysis.

8. The method for realizing cross-network communication based on dual one-way optical gates according to claim 7, characterized in that: The time updating method within the two networks is: based on the NTP protocol, the business application system and the internal office network information exchange platform maintain time synchronization; the business application system is the client and the internal office network information exchange platform is the server.

Images