Cross-network data security exchange method and device based on multilayer protection

Abstract

The invention discloses a cross-network data security exchange method and device based on multi-layer protection. The method comprises the steps that multiple layers comprise a physical layer, a transmission layer, an application layer and a strategy layer; the physical layer adopts a one-way transmission optical shutter as a physical isolation means, the transmission layer adopts a hybrid encryption strategy combining asymmetric encryption and symmetric encryption, and the application layer is used for processing authority control, flow control, interface control, type control and sensitive data desensitization. The strategy layer guarantees the security of data exchange based on a bastion host, a black list, a white list and a log auditing mechanism; and the cross-network data security exchange method with multi-layer protection comprises a process of exchanging data from a non-security side to a security side and a process of requesting data from the non-security side to the security side. According to the scheme, comprehensive protection is provided for communication between networks with different security levels, and a feasible technical path is provided for constructing an open and highly controlled data exchange platform.

Description

Technical Field

[0001] The present invention belongs to the field of computer data security, and in particular relates to a method and device for cross-network data security exchange based on multi-layer protection. Background Art

[0002] Cross-network file transfer refers to the transmission of file data between two or more networks, usually used in physically or logically isolated network environments. For example, an enterprise may isolate the intranet (the secure side, used to process confidential or sensitive data) from the extranet (the non-secure side, connected to the Internet) to prevent security risks such as information leakage and network attacks.

[0003] At present, the security technology of cross-network data exchange has made significant progress. As a physical isolation solution, the one-way transmission optical gate effectively gets rid of the inefficient means of manual ferrying that used to require the use of USB flash drives. It has been widely used in scenarios with high security requirements and effectively prevents reverse attacks. Encryption technologies such as asymmetric encryption (RSA) and symmetric encryption (AES) are widely used to ensure confidentiality and integrity during data transmission. Although these technologies have improved the security and efficiency of cross-network data exchange to a certain extent, there are still problems such as low integration with actual business and lack of multi-layer protection mechanisms.

[0004] For example, in the prior art, an invention patent with a publication number of CN111654364A discloses a method for realizing data security communication by applying blockchain encryption technology. By constructing a secure communication system of data layer, data encryption layer, data network layer, data transmission layer and data application layer, blockchain technology is integrated into data communication to realize secure data transmission, so that the transmitted data can be shared and cannot be tampered with, and the encryption performance of data is improved. Through systematic construction, remote, online and real-time data collection and application can be realized, so that users do not need to be on site to realize the application, management and monitoring of database data. The invention adopts the ant colony algorithm, and according to the characteristics of data communication and the needs of interactive devices, it performs optimal search of encryption algorithms among multiple encryption units, so that users can quickly find the optimal value of target data suitable for application from multiple encryption algorithms, which greatly improves the efficiency of encryption unit application algorithm and data management capabilities.

[0005] The above cross-network data exchange solutions mainly focus on file transfer and basic data transmission, usually using FTP, SFTP, SMB and other protocols or dedicated file transfer tools. These solutions have a certain effect in ensuring data integrity, but there are two main problems:

[0006] Lack of multi-layer protection mechanism: Many solutions rely on a single security measure (such as simple encryption or physical isolation) and cannot cope with complex network security threats. For example, traditional file transfer methods such as network gates and FTP servers can achieve data movement, but there are security risks and cannot meet the strict requirements of enterprises for data security and business processes.

[0007] Lack of close integration with actual business processes: It is difficult to provide real-time data verification and access control functions in processing sensitive information storage, transmission and verification. Data often only supports one-way flow, which greatly limits the flexibility and practicality in complex business scenarios. Summary of the invention

[0008] A brief summary of embodiments of the present invention is provided below to provide a basic understanding of certain aspects of the present invention. It should be understood that the following summary is not an exhaustive summary of the present invention. It is not intended to identify key or important parts of the present invention, nor is it intended to limit the scope of the present invention. Its purpose is merely to provide certain concepts in a simplified form as a prelude to a more detailed description discussed later.

[0009] The idea of ​​the present invention is as follows: In view of the problem of lack of multi-layer protection mechanism in traditional cross-network data exchange solutions, the present invention proposes a data security multi-layer protection technology, including physical layer, transmission layer, application layer and policy layer, to form a multi-level security protection system; in view of the lack of close integration with actual business processes and difficulty in providing real-time data verification and access control functions, the present invention constructs an efficient data exchange service based on the above-mentioned multi-layer data security protection technology, which not only formulates a detailed data exchange protocol, defines data format, transmission rules and security requirements, and ensures data consistency and security, but also realizes two-way real-time communication through technologies such as WebSocket to meet the needs of application scenarios that require instant response.

[0010] Specifically, according to one aspect of the present application, a method for secure cross-network data exchange based on multi-layer protection is provided, wherein the multiple layers include a physical layer, a transport layer, an application layer, and a policy layer;

[0011] The physical layer uses a one-way transmission optical gate as a physical isolation means to ensure that data in the high-security area cannot be accessed externally;

[0012] The transport layer adopts a hybrid encryption strategy including asymmetric encryption and symmetric encryption. Asymmetric encryption is used for key exchange to ensure the security of key transmission; symmetric encryption is used for data encryption to improve data transmission efficiency.

[0013] The application layer is used to process permission control, flow control, interface control, type control and sensitive data desensitization; among them, permission control adopts role-based access control (RBAC), assigns different permissions according to the user's role, and only authorized users can access specific resources; flow control adopts a current limiting mechanism to prevent service overload caused by malicious requests and ensure the stability and security of the system; interface control is to strictly control the access to the interface, limit unnecessary interface exposure, and reduce the attack surface; type control is to strictly control the data type to prevent illegal data injection and format errors; sensitive data desensitization is to partially hide or desensitize sensitive data at the business level to reduce the risk of data leakage;

[0014] The policy layer ensures the security of data exchange based on the bastion host, black and white lists, and log audit mechanism; strengthens system management through the bastion host, records all administrators' operation behaviors, facilitates auditing and tracking, and improves the traceability and transparency of the system; filters illegal access attempts through black and white lists to further enhance system security. The white list allows designated IP addresses or users to access, while the black list prohibits known malicious IP addresses or users; through the log audit mechanism, detailed synchronous and asynchronous log records record all operations and access behaviors, which is convenient for tracking and auditing, and timely detection and response to abnormal behaviors.

[0015] Among them, the data in the transport layer is compressed before transmission, which reduces the transmission bandwidth occupancy and improves the transmission efficiency; at the same time, the compressed data is more difficult to be directly parsed, thus enhancing the security of the data.

[0016] This application uses the above-mentioned multi-layer protection solution to make corresponding settings at different layers, including physical isolation measures at the physical layer, permission control, flow control, interface control, type control and sensitive data desensitization strategies at the application layer, bastion host, black and white list and log audit mechanism at the policy layer to ensure the real-time, integrity and reliability of the data, and through log records and audits, the source, destination and usage of the data can be tracked.

[0017] The multi-layer protection cross-network data security exchange method includes the process of exchanging data from the non-secure side to the secure side, the data management mechanism on the secure side, and the process of non-secure side requesting data from the secure side;

[0018] The process of exchanging data from the non-secure side to the secure side includes: encrypting and compressing the data on the non-secure side, and then transmitting it to a specific directory on the secure side through a one-way transmission optical gate; the cross-network data security exchange service on the secure side scans, decompresses, decrypts and stores the specific directory on the secure side, and saves the overall process of scanning, decompressing, decrypting and storing;

[0019] The process of the non-secure side requesting the secure side data includes: (the service caller) sending a request to the non-secure side cross-network data security exchange service, the non-secure side cross-network data security exchange service generates a request file and encrypts and compresses the request file, and then transmits it to the secure side specific directory through a one-way transmission optical gate, the secure side cross-network data security exchange service finds the request data according to the unique ID of the decompressed and decrypted request file, and encrypts and decompresses the request data and the unique ID, and transmits them to the non-secure side specific directory using the one-way transmission optical gate, the non-secure side cross-network data security exchange service decompresses and decrypts the non-secure side specific directory, obtains the request data and the unique ID, and feeds them back to the service caller;

[0020] The security side data management mechanism includes:

[0021] When deploying and operating the cross-network data security exchange service on the security side, you need to use a bastion host for management and operation, and direct connection to the server is not allowed;

[0022] The highly sensitive data management page provided by the cross-network data security exchange service on the security side must use a black and white name mechanism to allow only people with specific accounts and specific IP addresses to access it;

[0023] The cross-network data security exchange service on the security side will perform virus scanning, type detection, and packet format detection on data packets from the non-security side to prevent malicious requests;

[0024] The secure cross-network data exchange service on the secure side will perform flow control on request-type data packets from the non-secure side to limit frequent requests.

[0025] If the existing cross-network transmission scheme is to ensure high security, the transmission efficiency will be sacrificed. If the data is to have good continuity and efficient transmission, the security will be sacrificed. In order to enhance the security of data, as a further implementation scheme, when transmitting large amounts of data, in order to ensure real-time performance, the present invention also makes the following improvements:

[0026] In the process of exchanging data from the non-secure side to the secure side and the process of the non-secure side requesting data from the secure side, the following operations are performed before using the one-way transmission optical gate to transmit data:

[0027] An automatic packet splitting tool and an automatic packet splitting strategy configuration table are pre-designed. The automatic packet splitting strategy configuration table includes multiple packet splitting strategies. Different packet splitting strategies correspond to different maximum number of bytes of packet splitting.

[0028] Detect whether the size of the data to be transmitted is greater than a preset value. If so, detect the type of the data to be transmitted at the same time, select a corresponding packetization strategy according to the type, call the automatic packetization tool to packetize the data to be transmitted, and set an ordered label for each packet after packetization;

[0029] At the same time, after being transmitted to the corresponding non-secure side specific directory or secure side specific directory, the labels of multiple data packets under the directory are extracted to check whether the data packets are complete. If complete, they are decompressed and decrypted.

[0030] Through the above scheme, a suitable packetization strategy is selected according to the size and type of data to be transmitted, thereby improving the efficiency and reliability of data transmission.

[0031] In the prior art, the security side is generally the same organization, and some of its file data is shared. Therefore, in order to further improve the efficiency of data transmission, as a further implementation scheme, in the process of the non-security side requesting the security side data, the characteristic field of each requested file is saved to a preset directory on the security side. The cross-network data security exchange service on the security side regularly (at intervals) detects the characteristic fields of the preset directory on the security side, and sorts them according to the frequency of the characteristic fields. The request files corresponding to the characteristic fields whose frequency exceeds the preset value are saved in a cache. At the same time, the frequency of the characteristic field is not constant, so the cross-network data security exchange service on the security side will regularly clean up the cache according to the frequency of the characteristic field, and delete the source data whose frequency of the characteristic field drops below the preset value within the preset period. Through this scheme, the data transmission efficiency is greatly optimized, and unnecessary repeated transmission and storage operations are reduced. By caching those frequently requested data, the network bandwidth occupancy and transmission delay can be significantly reduced, thereby improving the overall data processing speed and system response time.

[0032] As a specific implementation scheme, the process of exchanging data from the non-secure side to the secure side includes:

[0033] Step (1), the data generated in the non-security side business platform is recorded as RawData;

[0034] Step (2), determine whether RawData is highly sensitive information, if so, record the data as SensitiveData and go to the next step, otherwise go to step (11);

[0035] Step (3), submitting SensitiveData to the non-secure cross-network data security exchange service CNSDE in the business interface;

[0036] Step (4), the non-secure side cross-network data security exchange service generates a unique data ID for SensitiveData, recorded as SDID, and then executes steps (5) and (8) in parallel;

[0037] Step (5), the non-secure cross-network data security exchange service CNSDE encrypts and compresses the SensitiveData, and after the processing is completed, proceeds to the next step;

[0038] a) Use the random key RandomKey to symmetric encrypt SDID and SensitiveData, and the encrypted result is recorded as EncryptedData;

[0039] b) Use the public key PublicKey to encrypt RandomKey, and the encrypted result is recorded as EncryptedKey;

[0040] c) Compress EncryptedKey and EncryptedData using a compression algorithm, and record the compressed result as CompressedData.

[0041] Step (6), use the one-way transmission shutter to transmit CompressedData to the specific directory on the security side. After the operation is completed, go to step (9). After the one-way shutter transmission is successful, step (7) will be triggered;

[0042] Step (7), the security side performs periodic scanning and detection on the cross-network data security exchange service CNSDE, and processes the CompressedData;

[0043] a) Decompress CompressedData to obtain EncryptedKey and EncryptedData;

[0044] b) Use the private key PrivateKey to decrypt EncryptedKey and obtain RandomKey;

[0045] c) Use RandomKey to decrypt EncryptedData to obtain SDID and SensitiveData;

[0046] d) Structuring the SDID and SensitiveData data and storing them in the security side database;

[0047] e) Completely record the entire process log from successful file scanning, decompression, decryption and storage;

[0048] Step (8), the non-secure side cross-network data security exchange service performs desensitization processing on the SensitiveData data, and the desensitized data is recorded as DesensitizedData. After the processing is completed, proceed to step (9);

[0049] Step (9), after waiting for step (5) and step (8) to be completed, the SDID and DesensitizedData are fed back to the service caller;

[0050] Step (10), the service caller stores the SDID and DesensitizedData in the service database for desensitized display on the front-end interface;

[0051] Step (11), the process ends.

[0052] As a specific implementation scheme, the process of the non-secure side requesting data from the secure side includes:

[0053] (1) When the non-secure side business platform needs to request the SensitiveData stored on the secure side, the request is recorded as SensitiveQuery; the unique data ID corresponding to the SensitiveData is recorded as SDID;

[0054] (2) Submit the SensitiveQuery asynchronously to the non-secure cross-network data security exchange service CNSDE, and start the timer to periodically detect the request and return the result;

[0055] (3) The non-secure side cross-network data security exchange service CNSDE generates a request file SensitiveRequestFile and a unique request ID, where the unique request ID is recorded as SRID; the request file contains SRID and SDID, and the file is encrypted and compressed, and recorded as CompressedRequestFile after processing;

[0056] (4) Use the one-way transmission shutter to transmit CompressedRequestFile to the specific directory on the security side. After the operation is completed, go to step (7). After the one-way shutter transmission is successful, step (5) will be triggered;

[0057] (5) The security side performs regular scanning and detection on the cross-network data security exchange service CNSDE. After detection, the CompressedRequestFile is processed, and the corresponding SensitiveData is obtained from the security side database according to the SDID, and then the next step is performed;

[0058] (6) The cross-network data security exchange service CNSDE on the security side encrypts and compresses SRID, SDID, and SensitiveData, and the result is recorded as CompressedResponseFile;

[0059] (7) Use the one-way transmission shutter to transfer the CompressedResponseFile to a specific directory on the non-secure side;

[0060] (8) The non-secure side cross-network data security exchange service CNSDE performs regular scanning and detection. After detection, the CompressedResponseFile is decompressed and decrypted to obtain SRID, SDID, and SensitiveData;

[0061] (9) After the SRID and SDID are correctly matched in the timer judgment, Redis is used to notify the service caller of the request return result;

[0062] (10) The service caller uses WebSocket to push the request to the Web front-end page for display;

[0063] (11)The process ends.

[0064] At present, many cross-network data exchange solutions on the market often only focus on file ferrying and basic data transmission, rely on a single security measure, ignore the integration with specific business logic, and can only realize one-way data transmission, and do not support two-way interaction, which limits the flexibility and practicality in complex business scenarios. The cross-network data security exchange method and device based on multi-layer protection proposed in the present invention, by introducing a multi-layer protection mechanism, has made a large number of mutually integrated technical innovations in the physical layer, data transmission layer, application layer and policy layer, which not only enhances the information security protection capabilities in the traditional sense, but also better fits the special needs of modern enterprises in diversified application scenarios, providing users with a data exchange platform that is both safe and convenient. At the same time, it processes large data volumes and high-frequency requested data, which greatly enhances the efficiency of data transmission. DETAILED DESCRIPTION

[0065] With the rapid development of information technology and the increasing complexity of network environments, cross-network data exchange faces unprecedented security challenges. Especially in application scenarios involving sensitive information processing and data transmission between multi-level security domains, how to ensure that data flows efficiently and securely between different networks has become an urgent problem to be solved. At present, traditional data exchange methods often find it difficult to meet both high performance and high security requirements, especially when facing new attack methods such as advanced persistent threats (APTs). In addition, problems such as improper data desensitization and lax permission control also pose huge risks to enterprises. In response to these challenges, an embodiment of the present invention provides a cross-network data security exchange method and device based on multi-layer protection, which aims to provide comprehensive protection for communications between networks with different security levels, and provides a feasible technical path for building an open and highly controlled data exchange platform.

[0066] Specifically, the embodiment of the present invention provides a cross-network data security exchange method based on multi-layer protection, which has a multi-layer protection cross-network data exchange architecture, a multi-layer protection cross-network data exchange process and mechanism. The multi-layer protection cross-network data exchange architecture includes a physical layer, a transport layer, an application layer and a policy layer, forming a multi-level security protection system. The overall cross-network data exchange architecture is as follows:

[0067] The physical layer uses a one-way transmission optical gate as a means of physical isolation to ensure that data in the high-security area cannot be accessed externally. The one-way transmission optical gate only allows data to flow from the low-security area to the high-security area through hardware isolation to prevent reverse attacks, thereby effectively protecting the security of critical data.

[0068] The transport layer adopts a hybrid encryption strategy, combining asymmetric encryption and symmetric encryption to achieve key exchange and data encryption. Asymmetric encryption is used for key exchange to ensure the security of key transmission; symmetric encryption is used for data encryption to improve data transmission efficiency. At the same time, the transmitted data is also compressed to reduce the transmission bandwidth occupation, improve transmission efficiency, and enhance data security, because compressed data is more difficult to be directly parsed.

[0069] The application layer implements a system of processing such as permission control, flow control, interface control, type control and sensitive data desensitization. Role-based access control (RBAC) assigns different permissions according to the user's role to ensure that only authorized users can access specific resources; the current limiting mechanism can prevent service overload caused by malicious requests and ensure the stability and security of the system; strict control of interface access can limit unnecessary interface exposure and reduce the attack surface; strict control of data types can prevent illegal data injection and format errors; at the same time, sensitive data will be partially hidden or desensitized at the business level to reduce the risk of data leakage. For example, sensitive information such as ID number and mobile phone number can be partially hidden or replaced to ensure that even if the data is intercepted, the complete information cannot be obtained.

[0070] The policy layer uses bastion hosts, blacklists and whitelists, and log auditing mechanisms to maximize the security of data exchange. The bastion hosts strengthen system management, record all administrators' operations, facilitate auditing and tracking, and improve the traceability and transparency of the system; blacklists and whitelists filter illegal access attempts to further enhance system security. The whitelist allows access to specified IP addresses or users, while the blacklist prohibits known malicious IP addresses or users; the log audit mechanism records detailed synchronous and asynchronous logs, records all operations and access behaviors, facilitates tracking and auditing, and promptly detects and responds to abnormal behaviors.

[0071] The multi-layer protection cross-network data exchange process and mechanism include the process of exchanging data from the non-secure side to the secure side, the process of non-secure side requesting data from the secure side, and the data management mechanism on the secure side.

[0072] The process of exchanging data from the non-secure side to the secure side includes:

[0073] (1) Assume that the data generated in the non-security side business platform is RawData;

[0074] (2) Determine whether RawData is highly sensitive information (such as name, ID number, mobile phone number, and ID photo in user registration information). If so, record this type of data as SensitiveData and go to the next step; otherwise, go to step (11);

[0075] (3) In the business interface, SensitiveData needs to be submitted to the non-secure side Cross-Network Secure Data Exchange Service (CNSDE);

[0076] (4) Generate a unique data ID for SensitiveData, recorded as SDID, and then execute steps (5) and (8) in parallel;

[0077] (5) The non-security side CNSDE encrypts and compresses the SensitiveData, and then moves to the next step after the processing is completed;

[0078] a) Use a random key denoted as RandomKey to symmetric encrypt SDID and SensitiveData, and the encrypted result is denoted as EncryptedData;

[0079] b) Use the public key, denoted as PublicKey, to encrypt RandomKey, and the encrypted result is denoted as EncryptedKey;

[0080] c) Compress EncryptedKey and EncryptedData using a compression algorithm, and record the compressed result as CompressedData.

[0081] (6) Use a one-way transmission shutter (low-density to high-density shutter) to transmit CompressedData to a specific directory on the security side. After the operation is completed, go to step (9). After the one-way shutter transmission is successful, step (7) will be triggered;

[0082] (7) CNSDE on the security side periodically scans and detects, and processes CompressedData;

[0083] a) Decompress CompressedData to obtain EncryptedKey and EncryptedData;

[0084] b) Use the private key, denoted as PrivateKey, to decrypt EncryptedKey to obtain RandomKey;

[0085] c) Use RandomKey to decrypt EncryptedData to obtain SDID and SensitiveData;

[0086] d) Structuring the SDID and SensitiveData data and storing them in the security side database;

[0087] e) Completely record the entire process log from successful file scanning, decompression, decryption and storage.

[0088] (8) The non-security side CNSDE performs desensitization processing on the SensitiveData data (e.g., replacing information such as name, mobile phone number, and ID card with specific content such as asterisks). The desensitized data is recorded as DesensitizedData. After the processing is completed, proceed to step (9);

[0089] (9) After waiting for steps (5) and (8) to be completed, return SDID and DesensitizedData to the service caller;

[0090] (10) The service caller stores the SDID and DesensitizedData in the service database for desensitized display on the front-end interface;

[0091] (11)The process ends.

[0092] The specific process of the non-secure side requesting data from the secure side includes:

[0093] (1) Assume that the non-secure business platform needs to request SensitiveData on the secure side, and record the request as SensitiveQuery (e.g., requesting user identity information to be manually reviewed);

[0094] (2) Submit the SensitiveQuery asynchronously to the non-secure side CNSDE, and start the timer to periodically detect the request and return the result;

[0095] (3) The non-secure side CNSDE generates a request file named SensitiveRequestFile and a unique request ID named SRID. The file contains SRID and SDID, and encrypts and compresses the file, which is named CompressedRequestFile.

[0096] (4) Use a one-way transmission shutter (low-density to high-density shutter) to transmit CompressedRequestFile to a specific directory on the security side. After the operation is completed, go to step (7). After the one-way shutter transmission is successful, step (5) will be triggered.

[0097] (5) CNSDE on the security side periodically scans and detects, processes CompressedRequestFile after detection, obtains the corresponding SensitiveData from the security side database according to SDID, and then goes to the next step;

[0098] (6) CNSDE on the security side encrypts and compresses SRID, SDID, and SensitiveData, and the result is recorded as CompressedResponseFile;

[0099] (7) Using a one-way transmission shutter (high-density to low-density shutter), the CompressedResponseFile is transferred to a specific directory on the non-secure side;

[0100] (8) The non-secure side CNSDE performs periodic scanning and detection. After detection, it decompresses and decrypts the CompressedResponseFile to obtain the SRID, SDID, and SensitiveData.

[0101] (9) After the SRID and SDID are correctly matched in the timer judgment, Redis is used to notify the service caller of the request return result;

[0102] (10) The service caller uses WebSocket to push the request to the Web front-end page for display;

[0103] (11)The process ends.

[0104] In addition, in the process of exchanging data from the non-secure side to the secure side and the process of the non-secure side requesting data from the secure side, the following operations are performed before the data is transmitted using the one-way transmission optical gate:

[0105] An automatic packet splitting tool and an automatic packet splitting strategy configuration table are pre-designed. The automatic packet splitting strategy configuration table includes multiple packet splitting strategies. Different packet splitting strategies correspond to different maximum number of bytes of packet splitting.

[0106] Detect whether the size of the data to be transmitted is greater than a preset value. If so, detect the type of the data to be transmitted at the same time, select a corresponding packetization strategy according to the type, call the automatic packetization tool to packetize the data to be transmitted, and set an ordered label for each packet after packetization;

[0107] At the same time, after being transmitted to the corresponding non-secure side specific directory or secure side specific directory, the labels of multiple data packets under the directory are extracted to check whether the data packets are complete. If complete, they are decompressed and decrypted.

[0108] At the same time, in the process of the non-secure side requesting the secure side data, the characteristic fields of each request file SensitiveQuery are saved to a preset directory on the secure side. The secure side cross-network data security exchange service periodically (at intervals) detects the characteristic fields of the preset directory on the secure side, and sorts them according to the frequency of the characteristic fields. The request files corresponding to the characteristic fields whose frequency exceeds the preset value are saved in a cache. At the same time, the frequency of the characteristic field is not constant, so the secure side cross-network data security exchange service will regularly clean up the cache according to the frequency of the characteristic field, and delete the source data whose frequency of the characteristic field drops below the preset value within the preset period. Through this solution, the data transmission efficiency is greatly optimized, and unnecessary repeated transmission and storage operations are reduced. By caching those frequently requested data, the network bandwidth occupancy and transmission delay can be significantly reduced, thereby improving the overall data processing speed and system response time. In addition, this method can also help better manage data traffic and storage resources, ensuring that key data can be processed first and accessed quickly. The application scenarios of this solution are particularly suitable for cross-departmental collaboration, outsourcing cooperation, and remote office scenarios. When sensitive or important data needs to be shared between different security domains, the use of this efficient data caching mechanism can effectively ensure data security and transmission efficiency.

[0109] The security-side data management mechanism specifically includes:

[0110] (1) When deploying and maintaining CNSDE on the security side, a bastion host is required for management and operation, and direct connection to the server is not allowed;

[0111] (2) On the security side, the highly sensitive data management page provided by CNSDE must use a black and white name mechanism to allow only people with specific accounts and specific IP addresses to access it;

[0112] (3) The CNSDE on the security side will perform virus scanning, type detection, and packet format detection on the data packets from the non-security side to prevent malicious requests;

[0113] (4) The CNSDE on the security side will perform flow control on the request type packets from the non-security side to limit frequent requests.

[0114] Based on the above embodiments, a cross-network data security exchange device based on multi-layer protection is provided in this embodiment, including: a memory for storing a computer program; a processor for implementing the steps of the above-mentioned cross-network data security exchange method based on multi-layer protection when executing the computer program.

[0115] At present, many cross-network data exchange solutions on the market often only focus on file ferrying and basic data transmission, rely on single security measures, ignore the integration with specific business logic, and can only realize one-way data transmission, and do not support two-way interaction, which limits the flexibility and practicality in complex business scenarios. The present invention proposes a cross-network data security exchange method and device based on multi-layer protection. By introducing a multi-layer protection mechanism, a large number of technical innovations have been made in the physical layer, data transmission layer, application layer and policy layer, which not only enhances the information security protection capability in the traditional sense, but also better meets the special needs of modern enterprises in diversified application scenarios, providing users with a safe and convenient data exchange platform.

[0116] The method and device for cross-network data security exchange based on multi-layer protection proposed by the present invention not only makes comprehensive security enhancement in cross-network data exchange, but also provides efficient data exchange capabilities, ensuring data security and business flexibility. It has wide application value in the field of computer data security, especially in scenarios with high data security requirements.

[0117] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0118] In addition, the method of the present invention is not limited to being executed in the time sequence described in the specification, and may also be executed in other time sequences, in parallel or independently. Therefore, the execution order of the method described in this specification does not limit the technical scope of the present invention.

[0119] Although the present invention has been disclosed above by describing specific embodiments of the present invention, it should be understood that all the above embodiments and examples are exemplary rather than restrictive. Those skilled in the art may design various modifications, improvements or equivalents of the present invention within the spirit and scope of the appended claims. These modifications, improvements or equivalents should also be considered to be included in the protection scope of the present invention.

Claims

1. A method for secure cross-network data exchange based on multi-layer protection, characterized in that: The multiple layers include physical layer, transport layer, application layer and policy layer; The physical layer uses a one-way transmission optical gate as a physical isolation means to ensure that data in the high-security area cannot be accessed externally; The transport layer adopts a hybrid encryption strategy combining asymmetric encryption and symmetric encryption. Asymmetric encryption is used for key exchange to ensure the security of key transmission; symmetric encryption is used for data encryption to improve data transmission efficiency. The application layer is used to process permission control, flow control, interface control, type control and sensitive data desensitization; The policy layer ensures the security of data exchange based on the bastion host, blacklist and whitelist, and log audit mechanism; the multi-layer protection cross-network data security exchange method includes the process of exchanging data from the non-secure side to the secure side and the process of non-secure side requesting data from the secure side; The process of exchanging data from the non-secure side to the secure side includes: encrypting and compressing the data on the non-secure side, and then transmitting it to a specific directory on the secure side through a one-way transmission optical gate, and the cross-network data security exchange service on the secure side scans, decompresses, decrypts and stores the specific directory on the secure side; The process of the non-secure side requesting the secure side data includes: sending a request to the non-secure side cross-network data security exchange service, the non-secure side cross-network data security exchange service generates a request file and encrypts and compresses the request file, and then transmits it to the secure side specific directory through a one-way transmission optical gate, the secure side cross-network data security exchange service finds the request data according to the unique ID of the decompressed and decrypted request file, encrypts and compresses the request data and the unique ID, and transmits them to the non-secure side specific directory using the one-way transmission optical gate, the non-secure side cross-network data security exchange service decompresses and decrypts the non-secure side specific directory, obtains the request data and the unique ID and feeds them back to the service caller.

2. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: The multi-layer protection cross-network data security exchange method also includes a security side data management mechanism, which includes: When deploying and operating the cross-network data security exchange service on the security side, you need to use a bastion host for management and operation, and direct connection to the server is not allowed; The highly sensitive data management page provided by the cross-network data security exchange service on the security side must use a black and white name mechanism to allow only people with specific accounts and specific IP addresses to access it; The cross-network data security exchange service on the security side will perform virus scanning, type detection, and packet format detection on data packets from the non-security side to prevent malicious requests; The secure cross-network data exchange service on the secure side will perform flow control on request-type data packets from the non-secure side to limit frequent requests.

3. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: In the application layer, permission control adopts role-based access control, which assigns different permissions according to the user's role, so that only authorized users can access specific resources; flow control adopts a flow limiting mechanism to prevent service overload caused by malicious requests and ensure the stability and security of the system; interface control is to strictly control the access to the interface, limit unnecessary interface exposure, and reduce the attack surface; type control is to strictly control the data type to prevent illegal data injection and format errors; Sensitive data desensitization is to partially hide or desensitize sensitive data at the business level to reduce the risk of data leakage.

4. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: In the policy layer, the bastion host is used to strengthen system management and record all administrator operations. The blacklist and whitelist filter illegal access attempts to further enhance system security. The whitelist allows specified IP addresses or users to access, while the blacklist prohibits known malicious IP addresses or users. Through the log audit mechanism, detailed synchronous and asynchronous log records are recorded to record all operations and access behaviors, which is convenient for tracking and auditing, and timely detection and response to abnormal behaviors.

5. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: In the transmission layer, data is compressed before transmission.

6. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: In the process of exchanging data from the non-safe side to the safe side and the process of the non-safe side requesting data from the safe side, the following operations are performed before the data is transmitted using the one-way transmission optical gate: An automatic packet splitting tool and an automatic packet splitting strategy configuration table are pre-designed. The automatic packet splitting strategy configuration table includes multiple packet splitting strategies. Different packet splitting strategies correspond to different maximum number of bytes of packet splitting. Detect whether the size of the data to be transmitted is greater than a preset value. If so, detect the type of the data to be transmitted at the same time, select a corresponding packetization strategy according to the type, call the automatic packetization tool to packetize the data to be transmitted, and set an ordered label for each packet after packetization; At the same time, after being transmitted to the corresponding non-secure side specific directory or secure side specific directory, the labels of multiple data packets under the directory are extracted to check whether the data packets are complete. If complete, they are decompressed and decrypted.

7. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: The non-secure side requesting secure side data flow also includes: After obtaining the decompressed and decrypted request file, the cross-network data security exchange service on the security side saves the characteristic fields of each request file to a preset directory on the security side; The cross-network data security exchange service on the security side periodically detects the characteristic fields of the preset directory on the security side, and sorts them according to the frequency of occurrence of the characteristic fields. The request files corresponding to the characteristic fields whose frequency of occurrence exceeds the preset value save their corresponding source data into a cache.

8. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: The process of exchanging data from the non-secure side to the secure side includes: Step (1), the data generated in the non-security side business platform is recorded as RawData; Step (2), determine whether RawData is highly sensitive information, if so, record the data as SensitiveData and go to the next step, otherwise jump to step (11); Step (3), submitting SensitiveData to the non-secure cross-network data security exchange service in the business interface; Step (4), the non-secure side cross-network data security exchange service generates a unique data ID for SensitiveData, recorded as SDID, and then executes steps (5) and (8) in parallel; Step (5), the non-secure cross-network data security exchange service encrypts and compresses the SensitiveData, and after the processing is completed, proceed to the next step; a) Use the random key RandomKey to symmetric encrypt SDID and SensitiveData, and the encrypted result is recorded as EncryptedData; b) Use the public key PublicKey to encrypt RandomKey, and the encrypted result is recorded as EncryptedKey; c) compress EncryptedKey and EncryptedData using a compression algorithm, and the compressed result is recorded as CompressedData; Step (6), use the one-way transmission shutter to transmit CompressedData to the specific directory on the security side. After the operation is completed, go to step (9). After the one-way shutter transmission is successful, step (7) will be triggered; Step (7), the security side periodically scans and detects the cross-network data security exchange service and processes the CompressedData; a) Decompress CompressedData to obtain EncryptedKey and EncryptedData; b) Use the private key PrivateKey to decrypt EncryptedKey and obtain RandomKey; c) Use RandomKey to decrypt EncryptedData to obtain SDID and SensitiveData; d) Structuring the SDID and SensitiveData data and storing them in the security side database; e) Completely record the entire process log from successful file scanning, decompression, decryption and storage; Step (8), the non-secure side cross-network data security exchange service performs desensitization processing on the SensitiveData data, and the desensitized data is recorded as DesensitizedData. After the processing is completed, proceed to step (9); Step (9), after waiting for step (5) and step (8) to be completed, the SDID and DesensitizedData are fed back to the service caller; Step (10), the service caller stores the SDID and DesensitizedData in the service database for desensitized display on the front-end interface; Step (11), the process ends.

9. The method for secure cross-network data exchange based on multi-layer protection according to claim 1, characterized in that: The process of the non-secure side requesting the secure side for data includes: (1) When the non-secure side business platform needs to request the SensitiveData stored on the secure side, the request is recorded as SensitiveQuery; the unique data ID corresponding to the SensitiveData is recorded as SDID; (2) Submit the SensitiveQuery asynchronously to the non-secure cross-network data security exchange service, and start the timer to periodically detect the request and return the result; (3) The non-secure side cross-network data security exchange service generates a request file SensitiveRequestFile and a unique request ID, where the unique request ID is recorded as SRID; the request file contains SRID and SDID, and the request file is encrypted and compressed, and recorded as CompressedRequestFile after processing; (4) Use the one-way transmission shutter to transmit CompressedRequestFile to the specific directory on the security side. After the operation is completed, go to step (7). After the one-way shutter transmission is successful, step (5) will be triggered; (5) The security side periodically scans and detects the cross-network data security exchange service. After detection, the CompressedRequestFile is processed, and the corresponding SensitiveData is obtained from the security side database according to the SDID, and then the next step is performed; (6) The cross-network data security exchange service on the security side encrypts and compresses SRID, SDID, and SensitiveData, and the result is recorded as CompressedResponseFile; (7) Use the one-way transmission shutter to transfer the CompressedResponseFile to a specific directory on the non-secure side; (8) The non-secure side performs regular scanning and detection on the cross-network data security exchange service. After detection, the CompressedResponseFile is decompressed and decrypted to obtain the SRID, SDID, and SensitiveData. (9) After the SRID and SDID are correctly matched in the timer judgment, the request return result is fed back to the service caller; (10) The service caller uses WebSocket to push the request to the Web front-end page for display; (11)The process ends.

10. A cross-network data security exchange device based on multi-layer protection, characterized in that: When executed, the device implements the steps of the cross-network data security exchange method based on multi-layer protection as described in any one of claims 1-9.