Unidirectional data transmission device and method

Abstract

The invention relates to the technical field of data transmission, and discloses a one-way data transmission device and method.The device comprises M levels of one-way service data sending channels and N levels of one-way control instruction sending channels, and the M levels of one-way service data sending channels are used for achieving one-way transmission of service data; the N-level one-way control instruction sending channel is used for realizing one-way transmission of a control instruction, and the M-level one-way service data sending channel and the N-level one-way control instruction sending channel can transmit the control instruction; wherein M is an integer greater than or equal to 2, and N is an integer greater than or equal to 2. The problems of low safety and the like in the prior art are solved.

Description

Technical Field

[0001] The present invention relates to the technical field of data transmission, and in particular to a unidirectional data transmission device and method. Background Art

[0002] In the current era of rapid development of information technology, data is a national basic strategic resource and a key element of social and economic development. With the popularization of information technology and the development of the Internet, data exchange and resource sharing have become an irreversible trend. By realizing data exchange and sharing between different networks / security domains, information silos can be broken and the sharing and utilization of knowledge and resources can be promoted. However, due to differences in security policies, security status, technical standards, and physical isolation between different networks, cross-network data transmission becomes extremely complex and difficult. At the same time, in important fields such as finance and national defense, in order to ensure the exchange of important business data, high requirements are placed on the security and reliability of data exchange. Therefore, designing a method and device that can ensure that data is only imported in one direction from the sender to the receiver while ensuring the security and reliability of data transmission has urgent practical needs and important application value.

[0003] Patent CN202111657245 is a high-reliability secure transmission and control system and method based on a one-way optical gate. This patent uses forward error correction coding technology to reduce the amount of transmission calculations and packet loss correction to ensure the reliability of the transmitted files; it encapsulates the one-way transmission private protocol to make the transmission more stable and improve the transmission efficiency. This patent can reduce the probability of bit error and packet loss in transmission, but it cannot completely solve the problem of unreliable transmission due to no feedback in data transmission and bit error and packet loss in transmission.

[0004] Patent CN202211246460 is a system based on a one-way reliable network security transmission protocol. The system based on the one-way reliable network security transmission protocol adopts a private communication protocol that complies with the national standard for security information, reduces the use of format information, and transmits data faster; qualified stream data packets are unpacked and repackaged and sent to the specified target IP client, which is more secure. The patent does not design for unreliable transmission such as one-way data transmission without feedback, transmission with bit errors and packet loss, and bypass of data security checks.

[0005] Patent CN202310598701 A network isolation ferry based on a unidirectional transmission channel. This patent provides a network isolation ferry based on a unidirectional transmission channel. By utilizing the unidirectional propagation characteristics of light, a unidirectional optical gate is deployed between two different security domains, and a unique channel for unidirectional information transmission is constructed by physical means to achieve unidirectional data transmission to ensure that data can only be transmitted in one direction, safely and reliably. This patent does not design for unreliable transmission such as unidirectional data transmission without feedback, transmission with bit errors and packet loss, and bypass of data security checks. Summary of the invention

[0006] In order to overcome the deficiencies of the prior art, the present invention provides a one-way data transmission device and method to solve the problems of low security and the like in the prior art.

[0007] The technical solution adopted by the present invention to solve the above problems is: A unidirectional data transmission device comprises an M-level unidirectional business data transmission channel and an N-level unidirectional control instruction transmission channel, wherein the M-level unidirectional business data transmission channel is used to realize unidirectional transmission of business data, and the N-level unidirectional control instruction transmission channel is used to realize unidirectional transmission of control instructions, and the M-level unidirectional business data transmission channel and the N-level unidirectional control instruction transmission channel can transmit control instructions; wherein, M≥2 and M is an integer, and N≥2 and N is an integer.

[0008] As a preferred technical solution, M=N=2, the M-level unidirectional business data sending channel includes a data sending processing unit, a first unidirectional transmission unit, an intermediate area security inspection unit, a second unidirectional transmission unit, and a data receiving processing unit that are communicatively connected in sequence, and the M-level unidirectional business data sending channel includes a control instruction security sending unit, a third unidirectional transmission unit, a control instruction security forwarding unit, a fourth unidirectional transmission unit, and a control instruction security receiving unit that are communicatively connected in sequence, the data receiving processing unit can unidirectionally transmit control instructions to the control instruction security sending unit, and the control instruction security receiving unit can unidirectionally transmit control instructions to the data sending processing unit.

[0009] As a preferred technical solution, the data transmission processing unit includes a data connection module and a first unidirectional transmission module, the intermediate area security inspection unit includes a first unidirectional receiving module, a first security inspection module, and a second unidirectional transmission module, the data reception processing unit includes a second unidirectional receiving module and a data push module, the data connection module, the first unidirectional transmission module, the first unidirectional transmission unit, the first unidirectional receiving module, the first security inspection module, the second unidirectional transmission module, the second unidirectional transmission unit, the second unidirectional receiving module, and the data push module are sequentially connected in communication; The control instruction security sending unit includes a second security check module and a third unidirectional sending module, the control instruction security forwarding unit includes a third unidirectional receiving module, a fourth unidirectional sending module, and a third security check module, the control instruction security receiving unit includes a fourth unidirectional receiving module and a fourth security check module, the second unidirectional receiving module, the second security check module, the third unidirectional sending module, the third unidirectional transmission unit, the third unidirectional receiving module, the third security check module, and the second unidirectional sending module are communicated and connected in sequence, the first unidirectional receiving module, the third security check module, the fourth unidirectional sending module, the fourth unidirectional transmission unit, the fourth unidirectional receiving module, the fourth security check module, and the first unidirectional sending module are communicated and connected in sequence.

[0010] A unidirectional data transmission method uses the unidirectional data transmission device to perform data transmission.

[0011] As a preferred technical solution, the business data message includes a header, a payload, and a trailer. The header includes a start character, an identifier, a task number, a packet sequence number, and an overall message length. The payload includes business data, and the trailer includes a check code and an end character.

[0012] As a preferred technical solution, the control instruction message includes a header, a payload, and a trailer. The header includes a start character, a control instruction code, and an overall message length. The payload includes packet loss information. The trailer includes a check code and an end character.

[0013] As a preferred technical solution, the intermediate zone security inspection unit performs packet loss detection based on the packet loss retransmission trigger condition, and if the packet loss retransmission trigger condition is met, sends a retransmission control instruction to the control instruction security forwarding unit; and / or; the data receiving and processing unit performs packet loss detection based on the packet loss retransmission trigger condition, and if the packet loss retransmission trigger condition is met, sends a retransmission control instruction to the control instruction security sending unit.

[0014] As a preferred technical solution, the packet loss retransmission triggering condition is: like and If the i+1th packet of the nth sending task has not been received at the time, the i+1th packet loss retransmission processing flow of the nth sending task is triggered; where n represents the sending task sequence number, i represents the packet sequence number in the nth sending task, Indicates the total number of messages sent for the nth sending task. Indicates the time when the i-th data packet is received in the n-th sending task. Indicates the set timeout period.

[0015] As a preferred technical solution, the data transmission processing unit and / or the middle zone security inspection unit performs unidirectional transmission rate control based on packet loss data statistics.

[0016] As a preferred technical solution, the sending rate control method is: when , the sending rate is reduced to , The calculation formula is as follows: ; when , then increase the sending rate to , The calculation formula is as follows: ; In the formula, = , ; in, Indicates that the one-way transmission processing module counts the number of retransmitted packet bits every T seconds. Indicates the sending rate after sending rate control. Indicates the average one-way transmission rate within T seconds. Indicates the time interval, Indicates the rate adjustment range. Indicates the maximum sending rate. Represents a configuration parameter.

[0017] Compared with the prior art, the present invention has the following beneficial effects: The present invention is aimed at the application scenario of real-time unidirectional import of high-security and high-reliability data in the field of cross-network exchange, and mainly solves the problems of unreliable transmission such as one-way data transmission without feedback, transmission with bit errors and packet loss, and the risk of data security check bypassing. In terms of security improvement, firstly, the middle area security inspection unit is set in a multi-level unidirectional manner, which reduces the risk of the middle area security inspection unit being hijacked and attacked; secondly, the security inspection module is deployed in a guard-like manner, which reduces the risk of data security check bypassing; thirdly, in the multi-level unidirectional control instruction sending channel, ASIC chips or logic-fixed FPGAs are selected to implement fine-grained inspection and re-inspection of the control instruction format and content, which reduces the risk of reverse non-compliant data transmission; in terms of reliability improvement, firstly, a multi-level unidirectional control instruction sending channel is constructed, and a packet loss retransmission processing mechanism is designed, so that the sending end can perceive the packet loss information and retransmit the packet loss data, thereby improving reliability; secondly, a rate control processing mechanism is designed to solve the problem of mismatch between the sending and receiving rates of one-way blind sending and improving transmission reliability. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 Block diagram of one-way data transmission model; Figure 2 A block diagram of the composition of a one-way data transmission device; Figure 3 Business data message format diagram; Figure 4 Control command message format diagram; Figure 5 Data security one-way import flow chart; Figure 6 Packet loss retransmission processing flow chart; Figure 7 Rate control process flow chart. DETAILED DESCRIPTION

[0019] The present invention will be further described in detail below in conjunction with embodiments and drawings, but the embodiments of the present invention are not limited thereto.

[0020] Example 1 like Figures 1 to 7 As shown, the scheme of the present invention being more specifically implemented is as follows: One-way data transfer model: The present invention is a measure to improve the security capability of a one-way data transmission model. Figure 1 As shown, the components in the model are described as follows: External network: The network from which data is exported, a network with a relatively low security level among the networks to which the one-way import zone is connected.

[0021] Internal network: The network where data is imported, a network with a relatively high security level among the networks connected to the one-way import zone.

[0022] Business server (sending): Deploy a server that is not in the external network and has the need to export data across networks. Install the cross-network sending application on the business server.

[0023] Business server (receiving): Deploy a server that is not in the external network and has the need to import data across networks. Install the cross-network receiving application on the business server.

[0024] Cross-network sending application: software that provides data export services, establishes a secure channel with a secure and reliable one-way data transmission device, and sends the exported business data.

[0025] Cross-network receiving application: software that provides data import services, establishes a secure channel with a secure and reliable one-way data transmission device, and receives imported business data.

[0026] UTM (Unified Threat Management): is a comprehensive network protection device that integrates firewall, intrusion detection and defense, antivirus and other functions to provide network boundary protection.

[0027] One-way data transmission device: A one-way data transmission device with high security and high reliability, consisting of two-level one-way business data transmission channels and two-level one-way control instruction transmission channels.

[0028] One-way data transmission device consists of: The unidirectional data transmission device consists of two-level unidirectional business data transmission channels and two-level unidirectional control instruction transmission channels. Figure 2 As shown, each functional unit and module is described as follows: 1. One-way business data sending channel: (1) Data sending processing unit: Data connection module: performs identity authentication and permission control with the cross-network sending application, establishes a secure channel through data encryption protection and other means, and receives business data sent by the cross-network sending application.

[0029] The first unidirectional sending module reads the business data received by the data connection module, calls the unidirectional interface to send data, has the function of receiving control instructions, implements data packet retransmission according to the control instructions, and can perform rate control function according to packet loss statistics.

[0030] (2) Intermediate area safety inspection unit: The first unidirectional receiving module: receives data and sends data to the processing unit unidirectionally, and has the function of checking packet loss and sending packet loss retransmission control instructions.

[0031] The first security inspection module: adopts a gatekeeper-style deployment to ensure that security inspection cannot be bypassed, provides data type, data content, data format inspection, and malicious code inspection functions, performs data inspection according to policies, intercepts and discards non-compliant data, and issues alarms.

[0032] The second unidirectional sending module: receives data that has passed the security check, calls the unidirectional interface to send data, has the function of receiving control instructions, implements data packet retransmission according to the control instructions, and can perform rate control according to packet loss statistics.

[0033] (3) Data receiving and processing unit: The second unidirectional receiving module: receives data and sends data to the processing unit unidirectionally, and has the function of checking packet loss and sending packet loss retransmission control instructions.

[0034] Data push module: performs identity authentication and permission control with cross-network receiving applications, establishes a secure channel through data encryption protection and other means, and pushes business data to cross-network receiving applications.

[0035] (4) The first unidirectional transmission unit: Optical fiber, light, electromagnetic waves and other methods are used to construct the only physical transmission device for one-way information transmission, and no information is transmitted in the reverse direction.

[0036] (5) Second unidirectional transmission unit: Optical fiber, light, electromagnetic waves and other methods are used to construct information unidirectional transmission devices. No information is transmitted in the reverse direction. The transmission throughput is consistent with that of the first unidirectional transmission unit and heterogeneous unidirectional transmission devices are used to achieve heterogeneous design.

[0037] Two-level one-way control instruction sending channel: (6) Control instruction safe sending unit: The second security inspection module: uses ASIC chips or FPGAs with solidified logic to implement it, and uses gatekeeper-style deployment to ensure that the inspection cannot be bypassed and the inspection logic cannot be changed in order to enhance security. It receives control instruction data, performs format and content checks on forwarding instructions, ensures that only instructions with specified formats and contents are sent, and intercepts, discards, and issues alarms for non-compliant data.

[0038] The third one-way sending module: receives control instruction data that passes the security check, and calls the one-way interface to send the instruction data.

[0039] (7) Control instruction security forwarding unit: The third one-way receiving module receives control instruction data and forwards it to the security inspection module.

[0040] The third security inspection module: ASIC chips or logic-solidified FPGAs are used for implementation, and gatekeeper-style deployment is used to ensure that the inspection cannot be bypassed and the inspection logic cannot be changed in order to enhance security. Control instructions are forwarded, and the format and content of the forwarded instructions are checked to ensure that only instructions with specified formats and contents are sent. Non-compliant data is intercepted, discarded, and an alarm is issued.

[0041] The fourth one-way sending module receives control instruction data that has passed the security check and calls the one-way interface to send the instruction data.

[0042] (8) Control instruction safety receiving unit: The fourth unidirectional receiving module receives control instruction data and forwards it to the security inspection module.

[0043] The fourth security inspection module: uses ASIC chips or logic-solidified FPGAs for implementation, and uses gatekeeper-style deployment to ensure that the inspection cannot be bypassed and the inspection logic cannot be changed, in order to enhance security. It forwards control instructions, and reviews the format and content of the forwarded instructions to ensure that only instructions with specified formats and contents are sent. Non-compliant data is intercepted, discarded, and an alarm is issued.

[0044] (9) The third unidirectional transmission unit: Optical fiber, light, electromagnetic waves and other methods are used to construct the only physical transmission device for unidirectional information transmission. No information is transmitted in the reverse direction. Since the amount of control instruction transmission is small, low-speed and cheap unidirectional transmission devices can be selected. At the same time, heterogeneous design is achieved with unidirectional transmission devices that are heterogeneous with the first unidirectional transmission unit and the second unidirectional transmission unit.

[0045] (10) Fourth unidirectional transmission unit: Optical fiber, light, electromagnetic waves and other methods are used to construct information unidirectional transmission devices. No information is transmitted in the reverse direction. Since the amount of control instruction transmission is small, low-speed and cheap unidirectional transmission devices can be selected. At the same time, heterogeneous design is achieved with unidirectional transmission devices that are heterogeneous to the first unidirectional transmission unit, the second unidirectional transmission unit, and the third unidirectional transmission unit.

[0046] Message format: The message formats transmitted between the internal units of the unidirectional data transmission device include service data messages and control command messages. Figure 2 shown.

[0047] 1. Business data message format: The service data message includes a header, a payload, and a trailer. Figure 3 The specific explanation is as follows: Start character: It is used as the start mark of the message and is a set of fixed values.

[0048] Identification: Message flag, used as the "start packet", "middle packet", and "end packet" flags for a group of sending tasks.

[0049] Task number: The task number for sending a set of data.

[0050] Packet sequence number: The packet number is numbered continuously starting from 1 and the maximum number does not exceed the maximum number of packets in a group of sending tasks.

[0051] Overall message length: the entire message length including header, payload, and trailer.

[0052] Payload: When the header flag is "start packet", it is the maximum packet length of the entire transmission task; when the header flag is "middle packet", it is the business data content; when the header flag is "end packet", it is empty.

[0053] Verification code: It is the message integrity verification value.

[0054] End character: It is used as the end mark of the message and is a set of fixed values.

[0055] 2. Control command message format: The control command message includes a header, a payload, and a trailer, such as Figure 4 The specific explanation is as follows: Start character: It is used as the start mark of the message and is a set of fixed values.

[0056] Control instruction code: Message flag, used as the "retransmission control" instruction flag.

[0057] Overall message length: the entire message length including header, payload, and trailer.

[0058] Payload: Packet loss information, including transmission task number and retransmission packet number, which varies within a certain range.

[0059] Verification code: It is the message integrity verification value.

[0060] End character: It is used as the end mark of the message and is a set of fixed values.

[0061] Basic process: 1. Data is safe and reliable, one-way import: Data safe and reliable one-way import mainly realizes the safe import of data from the sender to the receiver. The specific steps are as follows Figure 5 The steps are described as follows: (1) Starting device: The device is powered on and policy configuration is completed, allowing applications to be sent across the network for one-way data transmission.

[0062] (2) Data connection: After the cross-network sending application and the data access module complete identity authentication and establish a secure channel, the cross-network sending application sends business data to the data access module.

[0063] (3) One-way transmission of primary data: The unidirectional transmission module of the data transmission processing unit transmits the service data to the intermediate area security inspection unit through the unidirectional transmission link provided by the first unidirectional transmission unit.

[0064] (4) Data security check: The gatekeeper-style deployment is adopted to ensure that security checks cannot be bypassed. It provides data type, data content, data format check, malicious code and other inspection functions. Data inspection is performed according to the policy. Data that does not comply with the policy is intercepted, discarded and an alarm is issued.

[0065] (5) One-way transmission of secondary data: The middle zone security check unit forwards the business data that has passed the security check to the data receiving processing unit.

[0066] (6) Data push: After the cross-network receiving application and the data push module of the data receiving processing unit complete identity authentication and establish a secure channel, the data push module pushes the data to the cross-network receiving application.

[0067] 2. Packet loss retransmission processing: In order to solve the problem of one-way transmission bit error and packet loss, the data receiving processing unit and the intermediate area security inspection unit trigger the packet loss retransmission processing flow when they find packet loss. The retransmission processing flow is as follows: Figure 6 The steps are described as follows: (1) Starting device: The device is powered on and policy configuration is completed, allowing applications to be sent across the network for one-way data transmission.

[0068] (2) One-way data transmission: The one-way sending module in the data sending processing unit or the intermediate area security inspection unit sends data to the one-way receiving module.

[0069] (3) Packet loss detection: The one-way receiving module in the intermediate zone security inspection unit / data receiving processing unit performs packet loss detection based on the packet loss retransmission trigger condition. When the packet loss retransmission trigger condition is met, a retransmission control instruction is sent. The packet loss retransmission trigger condition is described as follows: The total number of messages sent for the nth sending task is ,set up The time when the i-th packet of data is received in the n-th sending task, and the timeout is set to ,when ,and When the i+1th packet data of the nth sending task has not been received, the packet loss retransmission processing flow of the i+1th packet of the nth sending task is triggered.

[0070] (4) Retransmission control instruction check: The security check module of the control instruction security sending unit or the control instruction security forwarding unit receives the retransmission control instruction and performs a fine-grained check on the format and content of the message format. Non-compliant messages are intercepted, discarded, and an alarm is issued.

[0071] (5) Receiving control instructions: The one-way receiving module in the control instruction safety forwarding unit or the control instruction safety receiving unit receives the control instruction and forwards it to the safety inspection module for re-inspection.

[0072] (6) Retransmission control command review: To improve security and prevent data leakage caused by non-compliant data transmission, the security inspection unit in the control instruction security forwarding unit or the control instruction security receiving unit performs a fine-grained inspection of the message format and content of the received retransmitted control instructions, and intercepts, discards and issues an alarm for non-compliant messages.

[0073] (7) Retransmission control instruction forwarding: The control instruction security forwarding unit or the control instruction security receiving unit forwards the retransmission control instruction that has passed the recheck to the intermediate area security inspection unit or the unidirectional sending module in the data sending processing unit.

[0074] (8) Packet loss retransmission: After receiving the retransmission control instruction, the unidirectional sending module parses the retransmission control instruction to retransmit the lost packet data.

[0075] 3. Rate control processing: In order to solve the problem of data accumulation buffer fullness and packet loss caused by the one-way receiving module's data receiving rate being greater than the data outgoing rate due to network congestion and untimely data security check processing, the one-way sending module performs one-way sending rate control based on packet loss data statistics. The rate control process is as follows: Figure 7 The steps are described as follows: (1) Starting device: Start the device and complete the policy configuration to allow applications to be sent across the network for one-way data transmission.

[0076] (2) Packet loss statistics: Data one-way sending module, calculate the maximum sending rate , the number of bits of retransmitted packets counted by the one-way transmission processing module every T seconds is , T is an adjustable parameter, the default is 10 seconds, and the average one-way transmission rate within T seconds is .

[0077] (3) Rate control: According to the packet loss data, the rate control method is as follows: when Then the sending rate reduction condition is triggered, and the adjustment rate is set to , The calculation formula is as follows:

[0078] when , trigger the condition of increasing the sending rate, and set the rate adjustment range to = , As a configuration parameter to adjust x, , the default is 0.1, set to adjust the one-way sending rate , The calculation formula is as follows:

[0079] The present invention is aimed at the application scenario of real-time unidirectional import of high-security and high-reliability data in the field of cross-network exchange, and mainly solves the problems of unreliable transmission such as one-way data transmission without feedback, transmission with bit errors and packet loss, and the risk of data security check bypassing. In terms of security improvement, firstly, the middle area security inspection unit is set in a multi-level unidirectional manner, which reduces the risk of the middle area security inspection unit being hijacked and attacked; secondly, the security inspection module is deployed in a guard-like manner, which reduces the risk of data security check bypassing; thirdly, in the two-level unidirectional control instruction sending channel and the multi-level unidirectional control instruction sending channel, ASIC chips or logic-fixed FPGAs are selected to implement fine-grained inspection and re-inspection of the control instruction format and content, which reduces the risk of reverse non-compliant data transmission; in terms of reliability improvement, firstly, a multi-level unidirectional control instruction sending channel is constructed, and a packet loss retransmission processing mechanism is designed, so that the sending end can perceive the packet loss information and retransmit the packet loss data, thereby improving reliability; secondly, a rate control processing mechanism is designed to solve the problem of mismatch between the sending and receiving rates of one-way blind sending and improving transmission reliability.

[0080] As described above, the present invention can be preferably implemented.

[0081] All features disclosed in all embodiments in this specification, or steps in all methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or expanded or replaced in any manner.

[0082] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. According to the technical essence of the present invention, within the spirit and principles of the present invention, any simple modification, equivalent replacement and improvement made to the above embodiment still falls within the protection scope of the technical solution of the present invention.

Claims

1. A one-way data transmission device, characterized in that: It includes an M-level unidirectional business data sending channel and an N-level unidirectional control instruction sending channel. The M-level unidirectional business data sending channel is used to realize unidirectional transmission of business data, and the N-level unidirectional control instruction sending channel is used to realize unidirectional transmission of control instructions. The M-level unidirectional business data sending channel and the N-level unidirectional control instruction sending channel can transmit control instructions; wherein, M≥2 and M is an integer, and N≥2 and N is an integer.

2. A one-way data transmission device according to claim 1, characterized in that: M=N=2, the M-level unidirectional business data sending channel includes a data sending processing unit, a first unidirectional transmission unit, an intermediate area security inspection unit, a second unidirectional transmission unit, and a data receiving processing unit that are sequentially connected in communication, and the M-level unidirectional business data sending channel includes a control instruction security sending unit, a third unidirectional transmission unit, a control instruction security forwarding unit, a fourth unidirectional transmission unit, and a control instruction security receiving unit that are sequentially connected in communication. The data receiving processing unit can unidirectionally transmit control instructions to the control instruction security sending unit, and the control instruction security receiving unit can unidirectionally transmit control instructions to the data sending processing unit.

3. A one-way data transmission device according to claim 2, characterized in that: The data transmission processing unit includes a data connection module and a first unidirectional transmission module, the intermediate area security inspection unit includes a first unidirectional receiving module, a first security inspection module, and a second unidirectional transmission module, the data reception processing unit includes a second unidirectional receiving module and a data push module, the data connection module, the first unidirectional transmission module, the first unidirectional transmission unit, the first unidirectional receiving module, the first security inspection module, the second unidirectional transmission module, the second unidirectional transmission unit, the second unidirectional receiving module, and the data push module are sequentially connected in communication; The control instruction security sending unit includes a second security check module and a third unidirectional sending module, the control instruction security forwarding unit includes a third unidirectional receiving module, a fourth unidirectional sending module, and a third security check module, the control instruction security receiving unit includes a fourth unidirectional receiving module and a fourth security check module, the second unidirectional receiving module, the second security check module, the third unidirectional sending module, the third unidirectional transmission unit, the third unidirectional receiving module, the third security check module, and the second unidirectional sending module are communicated and connected in sequence, the first unidirectional receiving module, the third security check module, the fourth unidirectional sending module, the fourth unidirectional transmission unit, the fourth unidirectional receiving module, the fourth security check module, and the first unidirectional sending module are communicated and connected in sequence.

4. A one-way data transmission method, characterized in that: Data transmission is performed using a unidirectional data transmission device as claimed in claim 2 or 3.

5. A one-way data transmission method according to claim 4, characterized in that: The business data message includes a header, a payload, and a trailer. The header includes a start character, an identifier, a task number, a packet sequence number, and the overall message length. The payload includes business data, and the trailer includes a check code and an end character.

6. A one-way data transmission method according to claim 4, characterized in that: The control command message includes a header, a payload, and a trailer. The header includes a start character, a control command code, and the overall message length. The payload includes packet loss information. The trailer includes a check code and an end character.

7. A one-way data transmission method according to any one of claims 4 to 6, characterized in that: The intermediate zone security inspection unit performs packet loss detection based on the packet loss retransmission trigger condition, and if the packet loss retransmission trigger condition is met, sends a retransmission control instruction to the control instruction security forwarding unit; and / or; the data receiving and processing unit performs packet loss detection based on the packet loss retransmission trigger condition, and if the packet loss retransmission trigger condition is met, sends a retransmission control instruction to the control instruction security sending unit.

8. A one-way data transmission method according to claim 7, characterized in that: The trigger conditions for packet loss retransmission are: like and If the i+1th packet of the nth sending task has not been received at the time, the i+1th packet loss retransmission processing flow of the nth sending task is triggered; where n represents the sending task sequence number, i represents the packet sequence number in the nth sending task, Indicates the total number of messages sent for the nth sending task. Indicates the time when the i-th data packet is received in the n-th sending task. Indicates the set timeout period.

9. A one-way data transmission method according to any one of claims 4 to 6, characterized in that: The data transmission processing unit and / or the middle zone security inspection unit performs unidirectional transmission rate control based on packet loss data statistics.

10. A one-way data transmission method according to claim 9, characterized in that: The sending rate control method is: when , the sending rate is reduced to , The calculation formula is as follows: ； when , then increase the sending rate to , The calculation formula is as follows: ； In the formula, = , ; in, Indicates that the one-way transmission processing module counts the number of retransmitted packet bits every T seconds. Indicates the sending rate after sending rate control. Indicates the average one-way transmission rate within T seconds. Indicates the time interval, Indicates the rate adjustment range. Indicates the maximum sending rate. Represents a configuration parameter.

Images