Intranet and extranet multi-device supervision system and method based on unidirectional isolation transmission device

Abstract

The invention relates to the technical field of network supervision, and discloses an intranet and extranet multi-device supervision system and method based on a one-way isolation transmission device, and the method comprises the steps that a prepositive server stores the device information of an extranet device; the first one-way isolation transmission equipment ferries the equipment information stored in the front server to a rear server; the rear server identifies a device identifier in the device information; the intranet management end reads the equipment identifier and the equipment information, analyzes the equipment information and issues an instruction; the rear server stores an instruction issued by the intranet management end; the second one-way isolation transmission equipment ferries the instruction stored in the rear server to the front server; the prepositive server controls the external network equipment to perform instruction operation according to the instruction; the problem that in a complex and mutually isolated network, information among multiple devices cannot be analyzed, shared and controlled in a centralized mode is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network supervision, and in particular to an internal and external network multi-device supervision system and method based on unidirectional isolation transmission equipment. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] In the same network environment, devices interact with the supervision platform through interface calls, report service status, system category and other parameters, and accept management from the supervision platform. Services between different networks are isolated from each other, and their own supervision procedures need to be deployed.

[0004] With the expansion of product scale and the popularity of remote work, devices are distributed in different network environments, including intranet and extranet. Existing supervision systems often find it difficult to achieve unified supervision of these scattered devices, especially when they span different network environments. Different networks cannot interact directly through interface calls, are isolated from each other, and cannot share information. Summary of the invention

[0005] In order to solve the above problems, the present invention provides an intranet and extranet multi-device supervision system and method based on a unidirectional isolation transmission device. Through the unidirectional isolation transmission device, the problem that information between multiple devices cannot be centrally analyzed, shared, and controlled in a complex and mutually isolated network is solved. There is no need to deploy multiple intranet management terminals in the intranet or extranet, which facilitates users to supervise global equipment. Operation and maintenance personnel do not need to log in to multiple intranet management terminals to conduct inspections or issue instructions.

[0006] In order to achieve the above object, the present invention adopts the following technical solution:

[0007] The first aspect of the present invention provides an intranet and extranet multi-device monitoring system based on a unidirectional isolation transmission device, which includes at least two unidirectional isolation transmission devices, a front-end server arranged on the external network, and a back-end server and an intranet management terminal arranged on the intranet; the back-end server and the intranet management terminal perform two-way interaction, and the front-end server is connected to a number of external network devices; the input end of at least one unidirectional isolation transmission device is connected to the front-end server, and the output end is connected to the back-end server, and the unidirectional isolation transmission device is called a first unidirectional isolation transmission device; the output end of at least one unidirectional isolation transmission device is connected to the front-end server, and the input end is connected to the back-end server, and the unidirectional isolation transmission device is called a second unidirectional isolation transmission device;

[0008] The front-end server is used to store device information of the external network device and control the external network device to perform command operations according to the command;

[0009] The first unidirectional isolation transmission device is used to ferry the device information stored in the front-end server to the back-end server;

[0010] The post-server is used to identify the device identifier in the device information and store the instructions issued by the intranet management terminal;

[0011] The intranet management terminal is used to read the device identification and device information, analyze the device information, and issue instructions;

[0012] The second unidirectional isolation transmission device is used to ferry the instructions stored in the back-end server to the front-end server.

[0013] Furthermore, the post-server is connected to a number of intranet devices;

[0014] The backend server is also used to store device information of the intranet device and control the intranet device to perform instruction operations according to the instructions.

[0015] Furthermore, the device information includes real-time network traffic and network alarm information.

[0016] Furthermore, the instructions include modifying a policy, restarting a device, and / or shutting down a program.

[0017] Furthermore, when the intranet management terminal reads the device information from the back-end server, a handshake verification is performed.

[0018] Furthermore, the device information is transmitted via an agreed message structure, and the device identifier is set to the agreed attribute of the message when collecting the device information.

[0019] Furthermore, the instruction is generated based on a result of analyzing the device information, or based on user demand.

[0020] Furthermore, the instruction is transmitted via an agreed message structure.

[0021] Furthermore, when the intranet management terminal reads the external network device information from the back-end server, the device identifier is used as a dimension.

[0022] The second aspect of the present invention provides an internal and external network multi-device supervision method of an internal and external network multi-device supervision system based on a unidirectional isolation transmission device according to the first aspect, comprising the following steps:

[0023] The front-end server stores the device information of the external network devices;

[0024] The first unidirectional isolation transmission device transfers the device information stored in the front-end server to the back-end server;

[0025] The backend server identifies the device identifier in the device information;

[0026] The intranet management terminal reads the device identification and device information, analyzes the device information, and then issues instructions;

[0027] The backend server stores the instructions issued by the intranet management terminal;

[0028] The second unidirectional isolation transmission device transfers the instructions stored in the rear-end server to the front-end server;

[0029] The front-end server controls the external network devices to perform command operations according to the instructions.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] The present invention provides an intranet and extranet multi-device monitoring system based on a unidirectional isolation transmission device. The system solves the problem that information between multiple devices cannot be centrally analyzed, shared, or controlled in a complex and mutually isolated network through the unidirectional isolation transmission device. The intranet or extranet does not need to deploy multiple intranet management terminals, which facilitates users' monitoring of global devices. Operation and maintenance personnel do not need to log in to multiple intranet management terminals to conduct inspections or issue instructions.

[0032] The present invention provides an internal and external network multi-device monitoring system based on a unidirectional isolation transmission device, which can collect device information of the internal and external network domains, and can also send instructions to the devices in the internal and external network domains to control the operation of the devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings, which constitute a part of the specification of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but do not constitute limitations of the present invention.

[0034] Figure 1 This is a structural diagram of an intranet and extranet multi-device monitoring system based on a unidirectional isolation transmission device according to the first embodiment of the present invention;

[0035] Figure 2 This is a flow chart of a method for supervising multiple devices in an internal and external network according to a second embodiment of the present invention. DETAILED DESCRIPTION

[0036] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0037] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.

[0038] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0039] In the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other. The present invention is further described below with reference to the accompanying drawings and embodiments.

[0040] Embodiment 1

[0041] The purpose of the first embodiment is to provide an intranet and extranet multi-device monitoring system based on a unidirectional isolation transmission device.

[0042] This embodiment provides an intranet and extranet multi-device monitoring system based on a unidirectional isolated transmission device, which realizes direct sharing of device information across network domains and solves the problem that services between different networks cannot interact directly.

[0043] like Figure 1 As shown, the present embodiment provides an intranet and extranet multi-device monitoring system based on a unidirectional isolation transmission device, comprising at least two unidirectional isolation transmission devices (single guide), a front-end server arranged on the external network, and a back-end server and an intranet management terminal arranged on the intranet; the back-end server and the intranet management terminal perform two-way interaction, the front-end server is connected to a number of external network devices, and the back-end server is connected to a number of intranet devices; the input end of at least one unidirectional isolation transmission device is connected to the front-end server, and the output end is connected to the back-end server; the output end of at least one unidirectional isolation transmission device is connected to the front-end server, and the input end is connected to the back-end server.

[0044] (1) For external network devices, one-way isolated transmission devices (single guide), front-end servers and internal network management terminals are implemented as follows:

[0045] The external network device information is collected and stored in a front-end server on the local side. The front-end server is used to store the device information of the external network device.

[0046] The external network device information stored in the front-end server of the low-density network is transferred to the back-end server of the high-density network through the one-way isolation transmission device. The ferrying is implemented as follows: the front-end server stores the external network device information to be transferred to the agreed directory, and the one-way isolation transmission tool is responsible for transferring it to the back-end server.

[0047] The intranet management terminal reads the external network device information from the back-end server, and the back-end server extracts the external network device identifier to identify the external network device, and synchronizes it to the intranet management terminal of the intranet for device information analysis.

[0048] Among them, when the intranet management end reads the device information from the back-end server, a handshake verification is performed to prevent the external network device information from being tampered with in the middle.

[0049] Among them, the internal and external network devices and the supervision platform (intranet management end) will establish a heartbeat connection and receive each other's heartbeat within the agreed interval time range. When the supervision platform finds that the heartbeat connection with the device is lost, it will actively cut off the information reporting channel of the device and set the status to offline until the device sends a heartbeat to the supervision platform again. When the device finds that the heartbeat with the supervision platform is disconnected, it will try to send a heartbeat to the supervision platform once a minute until the supervision platform returns a connection response.

[0050] The heartbeat function is implemented through message transmission. The heartbeat is a special message. When the management end interacts with the device through messages, it will parse and identify the heartbeat message to determine the other party's status. Each time a heartbeat message is received, a timestamp will be recorded. If the next heartbeat is not received within the scheduled time, it can be regarded as a heartbeat timeout.

[0051] Among them, the intranet management terminal reads the external network device information from the back-end server, including: taking the device ID (identification) of the hardware device that provides traffic or alarm as the dimension; receiving the traffic or alarm and other device information input by the external network device; the intranet management terminal analyzes and summarizes the above-mentioned received device information (such as whether the alarm is valid, whether the number reaches the tolerance threshold, etc.), generates charts or change curve information, and stores it in the database and other storage components of the supervision server (the server where the intranet management terminal is located).

[0052] Among them, the external network device information is transmitted through an agreed message structure. When collecting information on the external network device, the external network device number (external network device identification) will be set to the agreed attribute of the message. After the external network device information message is transmitted to the back-end server, the message needs to be parsed and the external network device number is obtained from the corresponding attribute, which is convenient for the internal network management end to analyze the external network device data and summarize and group the external network device messages.

[0053] The intranet management terminal issues instructions and stores them in the post-processing service of the intranet.

[0054] Among them, the intranet management end can issue instructions to the alarm device, such as modifying the policy, restarting the device, closing the program, etc.

[0055] The command message stored in the back-end server is transferred to the front-end server of the low-density network through another set of one-way isolation transmission equipment.

[0056] Among them, the generation of command messages can be triggered by the intranet management end after analyzing the data reported by the external network device. For example, a certain service status of some equipment is abnormal and needs to be restarted, the alarm strategy needs to be reset, the device server needs to be restarted, etc.; it can also be that the user sends a command message to the device as needed to control the device to perform corresponding operations, such as restarting the policy module, network module, etc.

[0057] Among them, the instruction also has a corresponding transmission message structure. The front-end device (external network device in a low-density network environment) can parse this message and respond accordingly according to the behavior agreed upon by the instruction.

[0058] Obtain the command message of the external network device from the internal network management end from the front-end server, and control the external network device to perform the corresponding command operation.

[0059] The external network device obtains instructions from the front-end server and performs response operations according to the instructions of the internal network management terminal.

[0060] (2) For intranet devices, one-way isolated transmission devices (single guide), front-end servers and intranet management terminals are used to implement the following interactions:

[0061] Collect intranet device information. The intranet device transmits the device information directly to the back-end server and stores it on the back-end server. The intranet supervision system reads the intranet device information from the back-end server, and the back-end server extracts the intranet device identifier to identify the intranet device, and synchronizes it to the intranet management end of the intranet to analyze the intranet device information. The intranet management end issues instructions and stores them in the back-end service of the intranet. The intranet device obtains the instruction message from the back-end server and performs corresponding operations according to the instructions.

[0062] For intranet devices, the only difference between device information, device identification extraction, device identification, device information analysis, and instructions from extranet devices is the deployment location of the corresponding devices. There is domain isolation between extranet devices and intranet devices. Device information needs to be transmitted from the front-end server to the back-end server via a single guide, so that it can be obtained and analyzed by the supervision platform. The instructions sent to the extranet are also imported from the back-end device to the front-end through a one-way import, and then distributed to the device. Because intranet devices are deployed in the same domain as the intranet management terminal, there is no need for a single guide, and device information can be directly transmitted to the back-end server, and then obtained and analyzed by the intranet management terminal. Intranet devices can also directly parse and receive instructions from the back-end server. Therefore, there is no difference in the message structure between the intranet and extranet devices and the supervision program.

[0063] In this embodiment, the collection of device information includes:

[0064] Collect real-time network traffic, and the traffic analysis module (all managed devices in the internal and external networks are equipped with traffic analysis modules) identifies the traffic proportions and usage of various applications from the traffic, and adds labels (such as Xiaohongshu, Douyin, and QQ Music in the external network), including the device ID, inspection time, and application type of the hardware device that provides real-time traffic. That is, the device information includes: real-time network traffic, the traffic proportions and usage of various applications, the device ID, inspection time, and application type of the hardware device that provides real-time traffic.

[0065] Collect device network alarm information, and the network module (all managed devices in the internal and external networks are equipped with network modules) identifies file detection strategy alarms (keyword detection, format file detection, malicious file detection), file screening alarms (encrypted file screening, multi-layer compressed file screening, etc.) and audit strategy alarms (target audit, network behavior audit, attack message reporting), etc. That is, device information includes: network alarm information, file detection strategy alarm information, file screening alarm information and audit strategy alarm information.

[0066] When processing folders, the managed devices on the external network will agree with the management end on a compression format to facilitate transmission and parsing. Among them, the file detection alarm information (file detection strategy alarm information) is in the form of a compressed folder (.tar.gz), and the naming format is as follows: device number_alarm reporting timestamp (accurate to milliseconds)_16-bit random number.tar.gz. Note: The file checksum is an md5 string, which can be used to verify the integrity of the file fragments. There is a json file and several source files inside the compressed file. The naming method of the alarm source file is: moduleCode_checksum_timestamp (accurate to seconds)_filename.fileType, that is, alarm strategy code_summary string_timestamp_original file name.original file type. The default Json file is alarm_msgs.txt.

[0067] Among them, Trojan and vulnerability alarms in the policy alarm are in the form of compressed files (.gz) in the following format: policy code_id_device number_file checksum_alarm reporting timestamp (accurate to seconds, such as 1639545488)_sessionId.file type.gz. sessionId is the session id.

[0068] Among them, the network behavior audit log is in the form of a compressed file (.gz), and the content format is as follows: policy code_id_device number_file checksum_alarm reporting timestamp (accurate to seconds, such as 1639545488). File type.gz.

[0069] The present invention solves the problem that information between multiple devices cannot be centrally analyzed, shared, or controlled in a complex and isolated network. There is no need to deploy multiple monitoring programs on the intranet or extranet, which facilitates users to monitor global devices. Operation and maintenance personnel do not need to log in to multiple devices for inspection or to issue instructions.

[0070] The devices and the centralized supervision platform of the present invention are asynchronously decoupled. The external network device only needs to interact with the front-end server, and the internal network supervision platform or the internal network device only needs to interact with the back-end server. The effect of this is that although there is no direct call interaction between interfaces, users cannot perceive the restrictions between network domains.

[0071] The supervision platform of the present invention can not only collect the device information of the internal and external network domains, but also send instructions to the devices of the internal and external network domains to control the operation of the devices.

[0072] The present invention timely delivers the network and alarm information of each device to the supervision platform, which is convenient for centralized analysis.

[0073] The intranet monitoring program can realize centralized monitoring of multiple devices in different network environments by logging into only one monitoring system, which improves the efficiency and security of device monitoring. It is convenient for device service health inspection, and can timely discover abnormal devices in complex networks to ensure the healthy operation of devices. It avoids the need for relevant personnel to log into the server where the devices are located one by one, or log into the device monitoring program of several network domains when troubleshooting device anomalies.

[0074] Embodiment 2

[0075] The purpose of the second embodiment is to provide an internal and external network multi-device supervision method based on the internal and external network multi-device supervision system based on the unidirectional isolation transmission device described in the first embodiment, such as Figure 2 As shown, the following steps are included:

[0076] Step 1: Start the docking program on the device and confirm the device number.

[0077] Step 2: Use a single-channel configuration to configure the front-end and back-end switching channels corresponding to the device to determine the source and target (the source and target here refer to the direction of data message transmission, that is, which devices the data comes from and which server it needs to be sent to. When the device reports a message, the source is the device itself and the target is the back-end server of the intranet. When the supervisory program issues an instruction, the source is the back-end server to which the message is sent, and the target is the corresponding internal or external network device).

[0078] Step 3: The device docking program actively initiates a registration request.

[0079] Step 4: Start the intranet monitoring program, audit the registered devices, establish a secure connection (DES encryption can be optionally enabled for interactive data), and respond to the audit results to the device.

[0080] Step 5: After the audit is passed, the device starts to report device information at intervals and periodically heartbeats the monitoring system of the intranet management end; the monitoring system will also heartbeat the device. Specifically, the front-end server stores the device information of the external network device, and the first one-way isolation transmission device transfers the device information stored in the front-end server to the back-end server; or, the back-end server stores the device information of the intranet device. The back-end server identifies the device identifier in the device information.

[0081] Step 6: The intranet management terminal analyzes the parameters and outputs a report. The intranet management terminal reads the device identification and device information, analyzes the device information, and issues instructions.

[0082] Step 7: The intranet management terminal sends instructions to the device based on the analysis results. Specifically, the back-end server stores the instructions issued by the intranet management terminal. The second unidirectional isolation transmission device transfers the instructions stored in the back-end server to the front-end server, and the front-end server controls the external network device to perform the instruction operation according to the instruction; or, the back-end server controls the intranet device to perform the instruction operation according to the instruction.

[0083] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0084] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. An intranet and extranet multi-device monitoring system based on a unidirectional isolation transmission device, comprising at least two unidirectional isolation transmission devices, a front-end server arranged on the extranet, a back-end server arranged on the intranet, and an intranet management terminal; the back-end server and the intranet management terminal perform two-way interaction, and the front-end server is connected to a number of extranet devices; the input end of at least one unidirectional isolation transmission device is connected to the front-end server, and the output end is connected to the back-end server, and the unidirectional isolation transmission device is called a first unidirectional isolation transmission device; the output end of at least one unidirectional isolation transmission device is connected to the front-end server, and the input end is connected to the back-end server, and the unidirectional isolation transmission device is called a second unidirectional isolation transmission device; The front-end server is used to store device information of the external network device and control the external network device to perform command operations according to the command; The first unidirectional isolation transmission device is used to ferry the device information stored in the front-end server to the back-end server; The post-server is used to identify the device identifier in the device information and store the instructions issued by the intranet management terminal; The intranet management terminal is used to read the device identification and device information, analyze the device information, and issue instructions; The second unidirectional isolation transmission device is used to ferry the instructions stored in the back-end server to the front-end server.

2. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: The backend server is connected to a number of intranet devices; The backend server is also used to store device information of the intranet device and control the intranet device to perform instruction operations according to the instructions.

3. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: The device information includes real-time network traffic and network alarm information.

4. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: The instructions include modifying policies, restarting devices, and / or shutting down programs.

5. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: When the intranet management terminal reads the device information from the back-end server, a handshake verification is performed.

6. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: The device information is transmitted via an agreed message structure, and the device identifier is set to the agreed attribute of the message when collecting the device information.

7. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: The instruction is generated based on the result of analyzing the device information or based on user needs.

8. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: The instructions are transmitted via a prescribed message structure.

9. The intranet and extranet multi-device monitoring system based on unidirectional isolation transmission equipment according to claim 1, characterized in that: When the intranet management terminal reads the external network device information from the back-end server, the device identifier is used as a dimension.

10. An internal and external network multi-device supervision method of an internal and external network multi-device supervision system based on a unidirectional isolation transmission device according to any one of claims 1 to 9, characterized in that: The steps include: The front-end server stores the device information of the external network devices; The first unidirectional isolation transmission device transfers the device information stored in the front-end server to the back-end server; The backend server identifies the device identifier in the device information; The intranet management terminal reads the device identification and device information, analyzes the device information, and then issues instructions; The backend server stores the instructions issued by the intranet management terminal; The second unidirectional isolation transmission device transfers the instructions stored in the rear-end server to the front-end server; The front-end server controls the external network devices to perform command operations according to the instructions.

Images