Bidirectional link implementation method and system in unidirectional gateway environment

Abstract

The invention provides a two-way link implementation method and system in a one-way gateway environment, and the method comprises the steps: setting a gateway at a gateway of a source host, and enabling the IP address of the gateway to be the IP address of first flow switching equipment; a network data packet sent by the source host application is received through a link sending service deployed by the first flow switching equipment application, and the network data packet is sent to the one-way gateway after being analyzed and subjected to strategy check; and receiving the network data packet transmitted by the one-way gateway through a link receiving service deployed by the second flow switching equipment application, and sending the network data packet to a destination host application after analyzing and policy checking the network data packet. And high-reliability and low-delay two-way communication of a data link is realized, and the method is particularly suitable for data transmission requirements in a high-security scene.

Description

Technical Field

[0001] The present application belongs to the field of network technology, and in particular, relates to a method and system for realizing a bidirectional link in a unidirectional gateway environment. Background Art

[0002] In some network environments with extremely high security levels, such as military command systems, financial transaction systems, nuclear power plant control systems, etc., a unidirectional gateway system is built into the network architecture for security protection purposes to prevent potential data leaks or external attacks. This "unidirectional gateway" design ensures that data can only be transmitted from the inside to the outside, and the outside cannot transmit data back. However, the limitation of this architecture is that full-duplex link transmission such as the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) cannot be used directly, resulting in complex system adaptation and affecting the overall stability and reliability of the system.

[0003] In the prior art, for data transmission in a unidirectional environment, it is necessary to adapt the gateway packet protocol of the unidirectional environment. It is difficult to change from a full-duplex data link to a unidirectional link, especially for an already built environment. Summary of the invention

[0004] The main purpose of the embodiments of the present invention is to provide a method and system for realizing a bidirectional link in a unidirectional gateway environment, which can realize high reliability and low-latency bidirectional communication of the data link, and is particularly suitable for data transmission requirements in high-security scenarios.

[0005] In a first aspect, a method for implementing a bidirectional link in a unidirectional gateway environment is provided, the method comprising: setting a gateway at the gateway of a source host, the IP address of the gateway being the IP address of a first-stream switching device; receiving a network data packet sent by a source host application through a link sending service deployed by an application of the first-stream switching device, and parsing and checking the network data packet for a policy before sending it to the unidirectional gateway; receiving a network data packet transmitted by the unidirectional gateway through a link receiving service deployed by an application of a second-stream switching device, and parsing and checking the network data packet for a policy before sending it to a destination host application.

[0006] In one possible implementation, a link sending service deployed by the first-stream switching device application receives a network data packet sent by a source host application, and parses and performs a policy check on the network data packet before sending it to a unidirectional gateway, including: creating a virtual network card on a physical machine of the first-stream switching device, redirecting all network data traffic of the external network card to the virtual network card, obtaining network information of the source host application and the destination host application according to the received network data packet through the virtual network card; performing a policy check based on the network information; if the policy check passes, encapsulating and performing an integrity check on the network data packet according to a preset protocol standard, sending the final data to the unidirectional gateway, and sending it to the destination host application through the unidirectional gateway.

[0007] In another possible implementation, the network information of the source host application and the destination host application is obtained according to the received network data packet through the virtual network card, including: parsing the received network data packet through the virtual network card to confirm whether the network data is safe and legal; obtaining the corresponding network information of the source host application and the destination host application according to the network data, and constructing a policy check request according to the network information.

[0008] In another possible implementation, a policy check is performed based on the network information, including: responding to the policy check request, querying the directory policy database based on the network information, and determining whether the source host application and the destination host application have one-way intercommunication authority; if the source host application and the destination host application do not have one-way intercommunication authority, determining that the policy check has failed, discarding the network data packet, and recording an audit log; if the source host application and the destination host application have one-way intercommunication authority, determining that the policy check has passed.

[0009] In another possible implementation, before performing a policy check based on the network information, it includes: providing an API interface for policy creation to the user, receiving directory information of the destination application and the source application customized by the user through the web interface through the API interface; associating the destination application and the source application through the policy, and generating a directory policy database.

[0010] In another possible implementation, a link receiving service deployed by a second-stream switching device application receives the network data packet transmitted by the unidirectional gateway, and parses and performs a policy check on the network data packet before sending it to a destination host application, including: after the second-stream switching device receives a data request sent by the unidirectional gateway, it receives the network data packet sent by the unidirectional gateway, decapsulates and performs an integrity check on the network data packet, and obtains network information of the source host application and the destination host application; performs a policy check based on the network information, and sends the parsed second network data packet to the destination host application after the policy check passes.

[0011] In another possible implementation, the network data packet is decapsulated and integrity checked to obtain the corresponding network information of the source host application and the destination host application, including: decapsulating the network data packet and verifying the network data packet through an integrity check code; parsing the network information of the source host application and the destination host application from the network data packet to construct a policy check request based on the network information of the source host application and the destination host application.

[0012] In a second aspect, a bidirectional link implementation system in a unidirectional gateway environment is provided, comprising: a first application host, a first flow switching device, a first unidirectional gateway, a second flow switching device, a second application host, and a second unidirectional gateway; the first application host, the first flow switching device, the first unidirectional gateway, the second flow switching device and the second application host are connected in sequence to form a link for the first application host to send data to the second application host; the second application host, the second flow switching device, the second unidirectional gateway, the first flow switching device and the first application host are connected in sequence to form a link for the second application host to send data to the first application host; a link sending service and a link receiving service are deployed in the first flow switching device and the second flow switching device; the link sending service is used to receive network data packets sent by a source host application, and send the network data packets to the unidirectional gateway after parsing and policy checking; the link receiving service is used to receive network data packets transmitted by the unidirectional gateway, and send the network data packets to the destination host application after parsing and policy checking.

[0013] In another possible implementation, the link sending service includes: a monitoring processing module, which is used to create a virtual network card on a physical machine, redirect all network data traffic of the external network card to the virtual network card, and obtain the corresponding network information of the source host application and the destination host application according to the received network data packet through the virtual network card; a first policy management module, which is used to perform a policy check based on the network information of the source host application and the destination host application corresponding to the network data packet; a first encoding and decoding module, which is used to encapsulate and perform integrity verification on the network data packet according to a preset protocol standard if the policy check passes, and send the final data to the unidirectional gateway.

[0014] In another possible implementation, the link receiving service includes: a second encoding and decoding module, used to receive the network data packet sent by the unidirectional gateway, decapsulate and integrity check the network data packet, and obtain the corresponding network information of the source host application and the destination host application; a second policy management module, used to perform a policy check based on the network information of the sending host application and the destination host application corresponding to the network data packet, and send the parsed network data packet to the destination host application after the policy check passes. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0016] Figure 1 A schematic diagram of the structure of a bidirectional link implementation system in a unidirectional gateway environment provided by an embodiment of the present invention;

[0017] Figure 2 A schematic diagram of a system for implementing a bidirectional link in a unidirectional gateway environment according to an embodiment of the present invention;

[0018] Figure 3 A schematic diagram of a link sending service of a bidirectional link implementation system in a unidirectional gateway environment according to an embodiment of the present invention;

[0019] Figure 4 A schematic diagram of a link receiving service of a bidirectional link implementation system in a unidirectional gateway environment according to an embodiment of the present invention;

[0020] Figure 5 The present invention provides a flowchart of a method for realizing a bidirectional link in a unidirectional gateway environment.

[0021] Specific implementation method

[0022] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar modules or modules with the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present invention.

[0023] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, modules and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, modules, components and / or groups thereof. It should be understood that when we refer to a module as being "connected" or "coupled" to another module, it may be directly connected or coupled to the other modules, or there may be intermediate modules. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any modules and all combinations of one or more associated listed items.

[0024] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation method of the present application will be further described in detail below with reference to the accompanying drawings.

[0025] The technical solution of the present application and how to solve the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0026] like Figure 1 The figure shows a structural schematic diagram of a bidirectional link implementation system in a unidirectional gateway environment provided by an embodiment of the present invention, the system comprising: a first application host A, a first flow switching device A, a first unidirectional gateway A, a second flow switching device B, a second application host B, and a second unidirectional gateway B.

[0027] The first application host A, the first flow switching device A, the first unidirectional gateway A, the second flow switching device B, and the second application host B are connected in sequence to form a link for the first application host A to send data to the second application host B. The second application host B, the second flow switching device B, the second unidirectional gateway B, the first flow switching device A, and the first application host A are connected in sequence to form a link for the second application host B to send data to the first application host A.

[0028] A link sending service and a link receiving service are deployed in the first-stream switching device A and the second-stream switching device B; the link sending service is used to receive network data packets sent by the source host application, and send them to the unidirectional gateway after parsing and checking the policies of the network data packets; the link receiving service is used to receive network data packets transmitted by the unidirectional gateway, and send them to the destination host application after parsing and checking the policies of the network data packets.

[0029] See also Figure 2, link sending services include:

[0030] The monitoring processing module is used to create a virtual network card on the physical machine, redirect all network data traffic of the external network card to the virtual network card, and obtain the network information of the corresponding source host application and the destination host application according to the received network data packets through the virtual network card;

[0031] A first policy management module, configured to perform policy checking according to network information of a source host application and a destination host application corresponding to a network data packet;

[0032] The first encoding and decoding module is used to encapsulate and perform integrity check on the network data packet according to the preset protocol standard if the policy check is passed, and send the final data to the unidirectional gateway.

[0033] The monitoring processing module of the link sending service creates a virtual network card on the physical machine. When the source sending host sends data to the destination application host, the monitoring processing module redirects all network data traffic from the specified external network card to the virtual network card. After the virtual network card receives the data packet from the network interface, it parses the network data packet to confirm whether the data is safe and legal. At the same time, it obtains the network information of the sending host application and the destination host application, and constructs this information into a policy check request to the policy management module. The policy management module provides users with an API interface for policy creation. Users customize the directory information of the destination application and the source application through the web interface, and associate the destination application with the source application through the policy. After receiving the policy check request from the monitoring processing module, the policy management module queries the directory policy database. When the monitoring processing module receives the feedback result from the policy management module that the source application and the destination application do not have an interoperability policy, the data packet is discarded and an audit log is recorded. When the monitoring processing module receives feedback from the policy management module that the source application and the destination application have an interoperability permission policy, the data packet is passed to the encoding and decoding module; after the encoding and decoding module receives the data packet, it encapsulates the data packet according to the proposed protocol standard, generates an integrity check code, and then sends the final data to the unidirectional gateway device.

[0034] Continue to see Figure 2 , link reception services include:

[0035] The second encoding and decoding module is used to receive the network data packet sent by the unidirectional gateway, decapsulate and perform integrity check on the network data packet, and obtain the corresponding network information of the source host application and the destination host application;

[0036] The second policy management module is used to perform a policy check according to the network information of the sending host application and the destination host application corresponding to the network data packet, and send the parsed network data packet to the destination host application after the policy check passes.

[0037] After the codec module of the link receiving service receives the data request sent by the unidirectional gateway device, it receives and caches the complete data, first decapsulates the data packet, and verifies the data packet through the integrity check code to ensure that the data is not tampered with during transmission; at the same time, it parses the source and destination application information from the data packet, and finally constructs a policy check request to the policy management module. After the policy management module receives the policy check request from the codec module, it queries the directory policy database. When the codec module receives the feedback result from the policy management module that the source application and the destination application do not have an interoperability policy, the data packet is discarded and an audit log is recorded. When the codec module receives the feedback result from the policy management module that the source application and the destination application have an interoperability policy, the parsed data is sent by calling the system's network interface. Since the parsed data packet contains complete network layer information, the data packet can be normally addressed and transmitted to the destination application.

[0038] If the first application host A sends data to the second application host B, the source IP port is the IP port of the first application host A, and the destination IP port is the IP port of the second application host B. Pre-deploy the link sending service and link receiving service on the first flow switching device A and the second flow switching device B. Set the IP address of the source host's gateway to the IP address of the host's first flow switching device A, and set the second application host B in the same way.

[0039] Application A in the first application host A sends data to application B in the second application host B. Link sending service and link receiving service are deployed in advance on the stream switching device hosts A and B, where the link sending service is used to receive data sent by the application and pass it to the unidirectional gateway after processing; the link receiving service is used to receive data from the unidirectional gateway and pass it to the application service after processing. On the stream switching devices A and B, the directory creation API interface provided by the policy management module is used to create the directory of applications A and B, and the policy creation API interface is used to create a new unidirectional intercommunication permission between applications A and B.

[0040] Link Send Service Figure 3 , receiving the network data packet sent by application A to application B, and verifying whether the network data packet payload data is legal. If the verification is successful, it is confirmed whether application A and application B have the right to communicate with each other. If they have the right, the data is encapsulated, and after generating a verification code, it is sent to the first unidirectional gateway A. If the verification fails, or application A and application B do not have the right to communicate with each other, the network data packet is discarded and the audit log is recorded.

[0041] That is, the monitoring processing module of the link sending service first creates a virtual network card in the physical machine, receives the data redirected by the network card connected to the first application host A, that is, the data sent by the first application host A to the second application host B; parses and verifies the data to confirm whether the network data packet payload data is legal; if it is illegal, discards the data and records it in the audit log; obtains the network information of the sending host application and the destination host application, and constructs this information into a policy check request to the first policy management module. After the first policy management module receives the policy check request from the monitoring processing module, it confirms whether there is one-way intercommunication permission between application A and application B by querying the directory policy database. When the monitoring processing module confirms through the first policy management module that there is no one-way intercommunication permission between application A and application B, the data packet is discarded and the audit log is recorded; otherwise, the data packet is passed to the next module, that is, the first encoding and decoding module. After the first encoding and decoding module receives the data packet processed by the monitoring processing module, it will encapsulate the data packet according to the protocol standard proposed by the unidirectional gateway. In order to prevent the data from being modified due to abnormal situations such as tampering of the intermediate data, the encoding and decoding module will call the verification card to generate an integrity check code and send the final data to the first unidirectional gateway A.

[0042] Link Receive Service Figure 4 , the link receiving service listens to the data sending request initiated by the first unidirectional gateway, receives and caches the complete data. Performs integrity check on the data. If the check passes, confirms whether the sender and receiver have unidirectional sending and receiving permissions. If they have permissions, the data is sent to the destination application, that is, application B, through the raw system interface. If they do not have permissions or the integrity check fails, the network data packet is discarded and the audit log is recorded.

[0043] That is, after the link receiving service of the second stream switching device B intercepts the data sending request of the first unidirectional gateway A, it first receives and caches the complete data, verifies the integrity of the data by calling the verification card to ensure that the data is not tampered with during the transmission process; then decapsulates the network data packet, parses the source and destination application information from the network data packet, and finally constructs a policy check request to the second policy management module. After the second policy management module receives the policy check request from the second codec module, it confirms whether application A and application B have unidirectional intercommunication authority by querying the directory policy database. When the second codec module confirms through the second policy management module that application A and application B do not have unidirectional intercommunication authority, the data packet is discarded and the audit log is recorded; otherwise, the decapsulated data packet is sent out by calling the system raw data sending interface. At this time, the data packet contains a complete network layer protocol message, the source IP port is the IP port of application A, and the destination IP port is the IP port of application B, so the data can be delivered to application B normally.

[0044] If the second application host B sends data to the first application host A, the link sending service in the second flow switching device B receives the network data packet sent by application B to application A and verifies whether the network data packet payload data is legal. If the verification is successful, it is confirmed whether application B and application A have the permission to communicate with each other. If they have the permission, the data is encapsulated, and after generating a verification code, it is sent to the second unidirectional gateway B. If the verification fails, or application B and application A do not have the permission to communicate with each other, the network data packet is discarded and an audit log is recorded. The link receiving service in the first flow switching device A monitors the data sending request initiated by the second unidirectional gateway B, receives and caches the complete data. The data is checked for integrity. If the verification passes, it is confirmed whether the sender and the receiver have the permission to send and receive in one direction. If they have the permission, the data is sent to the destination application, that is, application A, through the raw system interface. If they do not have the permission or the integrity check fails, the network data packet is discarded and an audit log is recorded.

[0045] The high-performance bidirectional link system in the unidirectional gateway environment of this embodiment uses a physical machine running the Linux system as the basis, deploys link receiving services and link sending services on the physical machine, and provides application directories and intercommunication policy authority management to the outside through the Restful interface, thereby improving the convenience of user control over the link; by constructing a simulated full-duplex link mechanism, the real-time and reliability of data transmission in the unidirectional gateway environment are greatly improved, the adaptation difficulty of applications in the system is simplified, and low-latency, high-reliability full-duplex link simulation is achieved, effectively improving the performance and security of data transmission.

[0046] like Figure 5 The figure shows a flow chart of a method for implementing a bidirectional link in a unidirectional gateway environment provided by an embodiment of the present invention, which is applied to the bidirectional link implementation system in the unidirectional gateway environment described above. The method for implementing a bidirectional link in a unidirectional gateway environment includes:

[0047] Step S11, setting a gateway on the source host, the IP address of the gateway is the IP address of the first flow switching device.

[0048] A similar setting is also performed on the destination host, that is, a gateway is set on the destination host, and the IP address of the gateway is the IP address of the second flow switching device. Link sending service and link receiving service are pre-deployed on the first flow switching device and the second flow switching device.

[0049] Step S12: receiving the network data packet sent by the source host application through the link sending service deployed by the first-stream switching device application, parsing and checking the network data packet, and then sending it to the unidirectional gateway.

[0050] Optionally, first create a virtual network card on the physical machine of the first-stream switching device, and redirect all network data traffic of the external network card to the virtual network card. The network information of the source host application and the destination host application is obtained through the virtual network card according to the received network data packet. Specifically, the received network data packet is parsed through the virtual network card to confirm whether the network data is safe and legal; at the same time, the network information of the corresponding source host application and the destination host application is obtained according to the network data, and a policy check request is constructed according to the network information.

[0051] Then, a policy check is performed based on the network information. Specifically, in response to the policy check request, the directory policy database is queried based on the network information to determine whether the source host application and the destination host application have the one-way intercommunication permission. If the source host application and the destination host application do not have the one-way intercommunication permission, it is determined that the policy check has failed, the network data packet is discarded, and the audit log is recorded. If the source host application and the destination host application have the one-way intercommunication permission, it is determined that the policy check has passed.

[0052] If the policy check passes, the network data packet is encapsulated and integrity checked according to the preset protocol standard, and the final data is sent to the unidirectional gateway, and then sent to the destination host application through the unidirectional gateway.

[0053] It should be noted that before performing a policy check based on network information, an API interface for policy creation is provided to users, and the directory information of the destination application and source application customized by the user through the web interface is received through the API interface; the destination application and the source application are associated through the policy to generate a directory policy database.

[0054] Step S13: receiving the network data packet transmitted by the unidirectional gateway through the link receiving service deployed by the second flow switching device application, parsing and policy checking the network data packet, and then sending it to the destination host application.

[0055] In an embodiment of the present invention, after receiving the data request sent by the unidirectional gateway, the second stream switching device receives the network data packet sent by the unidirectional gateway and caches it. The network data packet is decapsulated and integrity checked, and the network information of the source host application and the destination host application is obtained at the same time. Specifically, the network data packet is decapsulated, and the network data packet is checked by the integrity check code to ensure that the data is not tampered with during the transmission process. At the same time, the network information of the source host application and the destination host application is parsed from the network data packet to construct a policy check request based on the network information of the source host application and the destination host application. The network information of the source host application and the destination host application includes information such as the application name, IP, port, and the unidirectional gateway of the path link.

[0056] Then, a policy check is performed based on the network information, and the parsed second network data packet is sent to the destination host application after the policy check passes. That is, the directory policy database is queried in response to the policy check request. If the policy corresponding to the source application and the destination application does not exist, the data packet is discarded and the audit log is recorded. If the source application and the destination application have an interoperability permission policy, the parsed data is sent by calling the system's network interface. Since the parsed data packet contains complete network layer information, the data packet can be normally addressed and transmitted to the destination application. The unpacked data is a complete network layer data packet. When sending, there is no need to specify the sending protocol, source, and destination IP port. It is sent using raw socket.

[0057] The embodiment of the present invention simulates a full-duplex link channel in a unidirectional gateway environment, controls the link data security, reduces the difficulty of application adaptation system, and also ensures the stability of the system; by completely encapsulating the data packets on the network layer, the sending application and the receiving application can fully support all transport layer protocols between the sending and receiving application devices, without the need to perceive the construction of the intermediate link, which is user-friendly for setting up and using. The user is completely unaware during use and does not need to perform any additional configuration or adaptation work. At the same time, the user can control the unidirectional path of the link by setting the permission policy, which greatly improves the security of the system, reduces the complexity of management, and can achieve high reliability and low-latency two-way communication of the data link, which is particularly suitable for data transmission needs in high-security scenarios.

[0058] The method of the above embodiment is applied to the corresponding system in the above embodiment, and has the beneficial effects of the corresponding system embodiment, which will not be described in detail here.

[0059] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0060] The above is only a partial implementation of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for implementing a bidirectional link in a unidirectional gateway environment, characterized in that: The method comprises: Setting a gateway on the source host, wherein the IP address of the gateway is the IP address of the first-stream switching device; Receiving a network data packet sent by a source host application through a link sending service deployed by the first flow switching device application, parsing and checking the network data packet, and then sending the network data packet to a unidirectional gateway; The link receiving service deployed by the second stream switching device application receives the network data packet transmitted by the unidirectional gateway, and sends the network data packet to the destination host application after parsing and policy checking the network data packet.

2. The method according to claim 1, characterized in that The link sending service deployed by the first flow switching device application receives a network data packet sent by a source host application, and sends the network data packet to a unidirectional gateway after parsing and policy checking the network data packet, including: Creating a virtual network card on the physical machine of the first flow switching device, redirecting all network data traffic of the external network card to the virtual network card, and obtaining network information of the source host application and the destination host application through the virtual network card according to the received network data packets; Performing a policy check based on the network information; If the policy check passes, the network data packet is encapsulated and integrity checked according to the preset protocol standard, and the final data is sent to the unidirectional gateway, and then sent to the destination host application through the unidirectional gateway.

3. The method according to claim 2, characterized in that The obtaining the network information of the source host application and the destination host application according to the received network data packet through the virtual network card includes: Parsing the received network data packets through the virtual network card to confirm whether the network data is safe and legal; The corresponding network information of the source host application and the destination host application is acquired according to the network data, and a policy check request is constructed according to the network information.

4. The method according to claim 3, characterized in that The performing of policy checking according to the network information includes: In response to the policy check request, querying a directory policy database according to the network information to determine whether the source host application and the destination host application have one-way intercommunication authority; If the source host application and the destination host application do not have the unidirectional intercommunication permission, it is determined that the policy check fails, the network data packet is discarded, and an audit log is recorded; If the source host application and the destination host application have unidirectional intercommunication permissions, it is determined that the policy check passes.

5. The method according to claim 1, characterized in that Before performing the policy check according to the network information, the method includes: Providing a policy creation API interface to the user, and receiving directory information of the destination application and the source application customized by the user through the web interface through the API interface; The destination application and the source application are associated through the policy to generate a directory policy database.

6. The method according to claim 1, characterized in that The link receiving service deployed by the second flow switching device application receives the network data packet transmitted by the unidirectional gateway, and sends the network data packet to the destination host application after parsing and policy checking the network data packet, including: After receiving the data request sent by the unidirectional gateway, the second flow switching device receives the network data packet sent by the unidirectional gateway, decapsulates and performs integrity check on the network data packet, and obtains network information of the source host application and the destination host application; A policy check is performed according to the network information, and after the policy check passes, the parsed second network data packet is sent to the destination host application.

7. The method according to claim 6, characterized in that The decapsulating and integrity checking the network data packet to obtain the corresponding network information of the source host application and the destination host application includes: Decapsulating the network data packet and verifying the network data packet through an integrity check code; The network information of the source host application and the destination host application is parsed from the network data packet to construct a policy inspection request according to the network information of the source host application and the destination host application.

8. A bidirectional link implementation system in a unidirectional gateway environment, characterized in that: The system comprises: a first application host, a first flow switching device, a first unidirectional gateway, a second flow switching device, a second application host, and a second unidirectional gateway; The first application host, the first flow switching device, the first unidirectional gateway, the second flow switching device and the second application host are connected in sequence to form a link for sending data from the first application host to the second application host; The second application host, the second flow switching device, the second unidirectional gateway, the first flow switching device and the first application host are connected in sequence to form a link for the second application host to send data to the first application host; A link sending service and a link receiving service are deployed in the first flow switching device and the second flow switching device; the link sending service is used to receive network data packets sent by the source host application, and send the network data packets to the unidirectional gateway after parsing and policy checking; the link receiving service is used to receive network data packets transmitted by the unidirectional gateway, and send the network data packets to the destination host application after parsing and policy checking.

9. The system for realizing a bidirectional link in a unidirectional gateway environment as claimed in claim 8, characterized in that: The link sending service includes: A monitoring processing module is used to create a virtual network card on the physical machine, redirect all network data traffic of the external network card to the virtual network card, and obtain the network information of the corresponding source host application and the destination host application according to the received network data packets through the virtual network card; A first policy management module, configured to perform policy checking according to network information of a source host application and a destination host application corresponding to the network data packet; The first encoding and decoding module is used to encapsulate and perform integrity check on the network data packet according to a preset protocol standard if the policy check passes, and send the final data to the unidirectional gateway.

10. The system for realizing a bidirectional link in a unidirectional gateway environment as claimed in claim 8, characterized in that: The link receiving service includes: A second encoding and decoding module is used to receive the network data packet sent by the unidirectional gateway, decapsulate and perform integrity check on the network data packet, and obtain the corresponding network information of the source host application and the destination host application; The second policy management module is used to perform a policy check according to the network information of the sending host application and the destination host application corresponding to the network data packet, and send the parsed network data packet to the destination host application after the policy check passes.

Images