Method, device and equipment for unidirectional data transmission between high-security-level networks and low-security-level networks
By adopting the technology of combining Netty and RabbitMQ between high-security and low-security networks, problems such as inconsistent interfaces and insufficient security in the existing technology are solved, and efficient, secure and reliable multi-data type transmission is achieved.
Patent Information
- Application Number
- CN202411503822.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-25
- Publication Date
- 2025-03-18
AI Technical Summary
The prior art has problems such as inconsistent interfaces, insufficient security, poor real-time and reliability, and limited data type support in data transmission between high-security and low-security networks.
The Netty network scheduling framework and RabbitMQ message queue are combined with FTP file transfer technology, and the HTTPS request is received and checksum conversion is performed through the low-security network Netty scheduling service. RabbitMQ and FTP are used for transmission of different data types. The high-security network Netty scheduling service listens to the message queue and FTP files to ensure one-way data transmission.
It realizes a unified interface, enhances security, improves real-time and reliability, and supports the transmission of multiple data types, providing a safe, reliable and efficient data transmission solution.
Smart Images
Figure CN119652988A_ABST
Abstract
Description
Technical Field
[0001] The present disclosure relates to the field of data processing technology, in particular to the field of data transmission technology, and specifically to a method, device and equipment for unidirectional data transmission between networks with high and low security levels. Background Art
[0002] At present, in order to solve the technical problems faced in the safe and reliable data transmission between high-security level networks and low-security level networks, a secure data transmission system based on one-way transmission equipment is usually adopted. Such systems are widely used for data isolation and secure transmission between high-security level networks and low-security level networks. Based on this, the data isolation equipment between high-security level networks and low-security level networks usually adopts physical isolation, one-way network gates, software control and application layer protocol processing. Data isolation equipment based on application layer protocol processing usually uses message queues and file transfers for protocol conversion and processing to ensure that data can only be transmitted in one direction.
[0003] The main features and components of the above technical solution include:
[0004] One-way transmission devices: One-way transmission devices usually use hardware or software to ensure that data can only flow from a high-security network to a low-security network, but not in the opposite direction. These devices use physical or logical means to achieve unidirectional data flow, preventing sensitive data from being leaked or high-security networks from being attacked;
[0005] Dedicated interface: One-way transmission equipment usually provides dedicated interfaces for business systems to transmit data. These interfaces may require customized development to adapt to different business requirements and data formats, increasing the complexity of system integration and maintenance.
[0006] Limited data type support: One-way transmission devices mainly support structured data (such as database records) or simple file transfers;
[0007] Security mechanism: The security mechanism mainly relies on hardware isolation and simple authentication and authorization mechanism.
[0008] However, although these devices solve the data transmission problem between high-security level networks and low-security level networks to a certain extent and can ensure the unidirectionality of data transmission, they have the following shortcomings in actual applications:
[0009] 1. Inconsistent interfaces: Current one-way transmission solutions often require customized interfaces, which makes business system integration complex and costly;
[0010] 2. Insufficient security: Lack of effective authentication and authorization mechanisms makes it difficult to adapt to complex security requirements, which can easily lead to unauthorized data transmission, thus threatening system security;
[0011] 3. Poor real-time performance and reliability: The monitoring and management of data transmission is not perfect, and the support for scenarios with high requirements for real-time and reliability of data transmission is insufficient, making it difficult to ensure the real-time and integrity of data;
[0012] 4. Limited support for data types: The current solution has insufficient processing capabilities for structured and unstructured data and cannot meet the transmission requirements of different types of data. In other words, the support for complex unstructured data (such as multimedia files, large data sets, etc.) is relatively limited and cannot meet diverse transmission requirements. Summary of the invention
[0013] The present invention provides a method, device and equipment for unidirectional data transmission between networks with high and low security levels.
[0014] According to a first aspect of the present disclosure, a method for unidirectional data transmission between networks with high and low security levels is provided. The method comprises:
[0015] The low-security network Netty scheduling service receives the HTTPS request sent by the original service and performs requester IP verification and request signature verification according to the HTTPS request, and converts the HTTPS request into a fixed-format data message and file according to different data types;
[0016] RabbitMQ message queue, receiving the structured HTTPS request sent by the Netty scheduling service of the low security level network and sending it to the high security level network; FTP file, receiving the unstructured HTTPS request sent by the Netty scheduling service of the low security level network and sending it to the high security level network;
[0017] A high-security network Netty scheduling service monitors the RabbitMQ message queue and obtains structured HTTPS requests and sends them to the target service, obtains unstructured HTTPS requests from the FTP file and sends them to the target service;
[0018] The high-security-level network Netty scheduling service receives the response data sent by the target service and converts the response data into data messages and files in fixed formats according to different data types;
[0019] The RabbitMQ message queue receives the structured response data sent by the Netty scheduling service of the high security level network and sends it to the low security level network; the FTP file receives the unstructured response data sent by the Netty scheduling service of the high security level network and sends it to the low security level network;
[0020] The low-security-level network Netty scheduling service monitors the RabbitMQ message queue and obtains structured response data and converts it into HTTP response and sends it to the original service, obtains unstructured response data from the FTP file and converts it into HTTP response and sends it to the original service.
[0021] According to the aspects described above and any possible implementation method, an implementation method is further provided, wherein the low-security level network Netty scheduling service and the high-security level network Netty scheduling service are internally encapsulated with an HTTPS interface for converting HTTPS requests into data messages and files in a fixed format according to different data types.
[0022] According to the above aspects and any possible implementation, an implementation is further provided, wherein the performing requester IP verification and request signature verification according to the HTTPS request includes:
[0023] Based on the preset IP whitelist, perform IP verification of the requester according to the HTTPS request;
[0024] Based on the request signing key, a request signature verification is performed according to the HTTPS request.
[0025] According to the above aspects and any possible implementation, an implementation is further provided, wherein the acquisition of the preset IP whitelist includes:
[0026] In response to the application request signing key sent by the original service, the low-security level network Netty scheduling service configures the IP address of the original service as a whitelist.
[0027] According to the above aspects and any possible implementation manner, an implementation manner is further provided, after performing requester IP verification and request signature verification according to the HTTPS request, the method further includes:
[0028] Request format verification and data verification are performed according to the HTTPS request.
[0029] According to the aspects described above and any possible implementation methods, an implementation method is further provided, wherein the HTTPS request includes a signed request header, a defined Content-Type, a requested target address, a requested target path, a request method for the target service, and a request method for the target service.
[0030] According to the above aspects and any possible implementation manner, an implementation manner is further provided, wherein the method further includes:
[0031] The low-security-level network Netty scheduling service receives the response data of the unique number corresponding to the RabbitMQ message queue and / or the FTP file in a self-loop.
[0032] According to a second aspect of the present disclosure, a device for unidirectional data transmission between networks with high and low security levels is provided. The device comprises:
[0033] The low-security network Netty scheduling service module is used to receive the HTTPS request sent by the original service and perform requester IP verification and request signature verification according to the HTTPS request, and is also used to convert the HTTPS request into a fixed-format data message and file according to different data types;
[0034] A RabbitMQ message queue module is used to receive the structured HTTPS request sent by the Netty scheduling service of the low-security level network and send it to the high-security level network; an FTP file module is used to receive the unstructured HTTPS request sent by the Netty scheduling service of the low-security level network and send it to the high-security level network;
[0035] A high-security network Netty scheduling service module, used to monitor the RabbitMQ message queue and obtain structured HTTPS requests and send them to the target service, and also used to obtain unstructured HTTPS requests from the FTP file and send them to the target service;
[0036] The high-security-level network Netty scheduling service module is also used to receive response data sent by the target service, and is also used to convert the response data into data messages and files in a fixed format according to different data types;
[0037] The RabbitMQ message queue module is further used to receive the structured response data sent by the Netty scheduling service of the high security level network and send it to the low security level network; the FTP file module is further used to receive the unstructured response data sent by the Netty scheduling service of the high security level network and send it to the low security level network;
[0038] The low-security-level network Netty scheduling service module is also used to monitor the RabbitMQ message queue and obtain structured response data and convert it into HTTP response and send it to the original service, and is also used to obtain unstructured response data from the FTP file and convert it into HTTP response and send it to the original service.
[0039] According to a third aspect of the present disclosure, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.
[0040] According to a fourth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method described above is implemented.
[0041] The embodiments of the present application provide a method, device and equipment for unidirectional data transmission between high- and low-security level networks, which can receive HTTPS requests sent by the original service through the Netty scheduling service of the low-security level network, perform requester IP verification and request signature verification according to the HTTPS request, and convert the HTTPS request into data messages and files in a fixed format according to different data types; RabbitMQ message queue, receiving structured HTTPS requests sent by the Netty scheduling service of the low-security level network and sending them to the high-security level network; FTP file, receiving unstructured HTTPS requests sent by the Netty scheduling service of the low-security level network and sending them to the high-security level network; the Netty scheduling service of the high-security level network, listening to the RabbitMQ message queue and obtaining structured HTTPS requests and sending them to the target service, obtaining unstructured HTTPS requests from FTP files and sending them to the target service; the Netty scheduling service of the high-security level network, receiving the target The response data sent by the service is converted into fixed-format data messages and files according to different data types; the RabbitMQ message queue receives the structured response data sent by the Netty scheduling service of the high-security network and sends it to the low-security network; the FTP file receives the unstructured response data sent by the Netty scheduling service of the high-security network and sends it to the low-security network; the Netty scheduling service of the low-security network listens to the RabbitMQ message queue and obtains the structured response data and converts it into HTTP response and sends it to the original service, obtains the unstructured response data from the FTP file and converts it into HTTP response and sends it to the original service; based on this, by encapsulating the one-way transmission method, the Netty network scheduling framework is introduced to provide a standardized communication interface to the outside world, and combined with the RabbitMQ message queue and FTP file transfer technology, the business system can perform data transmission without perception, providing a more flexible and secure one-way data transmission solution. Specifically, unified interface: through standardized communication interface, the integration process of business system is simplified, and the development and maintenance costs are reduced; enhanced security: using request header signature and whitelist mechanism to ensure that only authorized data can be transmitted, ensuring the security and legality of data transmission, and improving system security; efficient real-time monitoring: using Netty's high-performance network scheduling capabilities, as well as the combination of message queues and FTP, real-time monitoring of data transmission status to ensure the real-time and reliability of data; multiple data type support: supporting the transmission of structured data and unstructured data to meet the transmission requirements of different types of data. In summary, through the above technical solutions, a safe, reliable and efficient solution is provided for data transmission between high-security level networks and low-security level networks, which improves the security and ease of use of data transmission.
[0042] It should be understood that the contents described in the summary of the invention are not intended to limit the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS
[0043] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure. In the accompanying drawings, the same or similar reference numerals represent the same or similar elements, among which:
[0044] Figure 1 A schematic diagram showing an exemplary operating environment in which embodiments of the present disclosure can be implemented;
[0045] Figure 2 Shows Figure 1 Schematic diagram of the interaction between the original service, the one-way data transmission system between high and low security level networks, and the target service shown in;
[0046] Figure 3 A flow chart of a method for unidirectional data transmission between networks with high and low security levels according to an embodiment of the present disclosure is shown;
[0047] Figure 4 A flowchart showing another method for unidirectional data transmission between networks with high and low security levels according to an embodiment of the present disclosure is shown;
[0048] Figure 5 A block diagram of a unidirectional data transmission device between high and low security level networks according to an embodiment of the present disclosure is shown;
[0049] Figure 6 A block diagram of an exemplary electronic device capable of implementing embodiments of the present disclosure is shown. DETAILED DESCRIPTION
[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present disclosure clearer, the technical solution in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present disclosure.
[0051] In addition, the term "and / or" in this article is only a description of the association relationship between the associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.
[0052] In this disclosure, by encapsulating the one-way transmission mode, the Netty network scheduling framework is introduced to provide a standardized communication interface to the outside world. Combined with the RabbitMQ message queue and FTP file transfer technology, the business system can perform data transmission without perception, providing a more flexible and secure one-way data transmission solution.
[0053] Figure 1 A schematic diagram of an exemplary operating environment 100 in which the embodiments of the present disclosure can be implemented is shown. The operating environment 100 includes an original service 102, a high-low security level network unidirectional data transmission system 104, and a target service 106.
[0054] Figure 2 Shows Figure 1 Schematic diagram of the interaction between the original service 102, the high and low security level network unidirectional data transmission system 104 and the target service 106 shown in FIG.
[0055] In some embodiments, the original service 102 may be an original service device that has a data transmission demand and sends request data in a low security level network.
[0056] In some embodiments, the target service 106 may be a target service device that responds to request data sent by the original service 102 and performs data transmission in a high-security level network.
[0057] In some embodiments, the high- and low-security-level network unidirectional data transmission system 104 includes a low-security-level network Netty scheduling service, a RabbitMQ message queue, an FTP file, and a high-security-level network Netty scheduling service. The high- and low-security-level network unidirectional data transmission system 104 is used to ensure that data can only flow from a high-security-level network to a low-security-level network, and cannot be transmitted in the reverse direction.
[0058] Among them, the low security level network Netty scheduling service and the original service 102 are deployed in the low security level network, the RabbitMQ message queue and FTP file are deployed in the physical isolation between the original service 102 and the target service 106, and the high security level network Netty scheduling service and the target service 106 are deployed in the high security level network.
[0059] In some embodiments, the physical isolation is a one-way transmission device, and a set of Netty scheduling services are deployed in the low-security level network and the high-security level network respectively. The service encapsulates the communication interface that converts HTTPS requests into fixed-format data messages and files according to different data types, and safely ferries HTTPS requests to the high-security level network through the RabbitMQ message queue and FTP file system provided by the one-way transmission device; at the same time, the high-security level network Netty scheduling service monitors RabbitMQ messages in real time, parses the messages, and selectively obtains FTP files according to different data types and converts them into HTTP format requests, sends the requests to the target service 106, and after obtaining the response, converts the response into fixed-format data messages and files according to different data types, and ferries the data back to the low-security level network in the same transmission mode; the service provides standardized HTTPS interfaces, application management of request signature keys, and management of IP black and white lists.
[0060] Specifically, the original service 102 sends request data, i.e., HTTPS request, to the Netty scheduling service deployed in the low-security network through IP blacklist and whitelist filtering and request signature authentication. The Netty scheduling service deployed in the low-security network converts the request data into a data format, such as converting structured data into a request message and converting unstructured data into a request file. The request message after the data format conversion is sent to the RabbitMQ message queue, and the request file after the data format conversion is sent to the FTP file, so as to securely ferry the request data to the high-security network. The Netty scheduling service deployed in the high-security network listens to the request message in the RabbitMQ message queue and obtains the request file from the FTP file, then directly parses the request message, and selectively obtains the request file according to different data types and converts it into a HTTP format request, and then sends it to the low-security network. The request data ferried from the secure network is sent to the target service 106; the target service 106 responds to the request data and sends response data to the Netty scheduling service deployed in the high security level network, and the Netty scheduling service deployed in the high security level network performs data format conversion on the response data, such as converting structured data into response messages and converting unstructured data into response files; the response message after data format conversion is sent to the RabbitMQ message queue, and the response file after data format conversion is sent to the FTP file, so as to safely ferry the response data to the low security level network; the Netty scheduling service deployed in the low security level network listens to the response message in the RabbitMQ message queue and obtains the response file from the FTP file, and then sends the response data ferried from the high security network to the original service 102; at this point, one-way data transmission between high and low security level networks is realized.
[0061] In summary, the above-mentioned one-way data transmission process between high-security and low-security level networks realizes secure one-way data transmission between high-security level networks and low-security level networks, mainly by encapsulating one-way transmission methods and providing HTTPS interfaces to the outside world, so that the business systems between the two networks can communicate using HTTPS without perception. The specific technical solution includes using Netty as the network scheduling framework, combining RabbitMQ message queues and FTP file transmission methods, and ensuring the security of network requests through the request header signature mechanism.
[0062] Figure 3 FIG. 3 is a flowchart of a method 300 for unidirectional data transmission between networks with high and low security levels according to an embodiment of the present disclosure. The method 300 may be Figure 1 The one-way data transmission system 104 between high and low security level networks is executed.
[0063] In box 310, the low-security network Netty scheduling service receives the HTTPS request sent by the original service and performs requester IP verification and request signature verification according to the HTTPS request, and converts the HTTPS request into fixed-format data messages and files according to different data types.
[0064] In box 320, the RabbitMQ message queue receives the structured HTTPS request sent by the Netty scheduling service of the low security level network and sends it to the high security level network; the FTP file receives the unstructured HTTPS request sent by the Netty scheduling service of the low security level network and sends it to the high security level network.
[0065] In block 330 , the high-security network Netty dispatch service listens to the RabbitMQ message queue and obtains the structured HTTPS request and sends it to the target service, obtains the unstructured HTTPS request from the FTP file and sends it to the target service.
[0066] In block 340 , the high-security-level network Netty dispatching service receives the response data sent by the target service and converts the response data into data messages and files in a fixed format according to different data types.
[0067] In box 350, the RabbitMQ message queue receives the structured response data sent by the Netty scheduling service of the high security level network and sends it to the low security level network; the FTP file receives the unstructured response data sent by the Netty scheduling service of the high security level network and sends it to the low security level network.
[0068] In box 360, the low-security network Netty dispatch service listens to the RabbitMQ message queue and obtains structured response data and converts it into HTTP response and sends it to the original service, obtains unstructured response data from the FTP file and converts it into HTTP response and sends it to the original service.
[0069] In box 310, Netty is a high-performance, asynchronous event-driven network application framework, which is mainly used to develop high-concurrency network applications and provides a flexible network scheduling mechanism and rich protocol support. It can effectively handle a large number of concurrent connections. In one-way data transmission between high and low security level networks, Netty can be selected as the network scheduling framework to improve the efficiency and reliability of data transmission.
[0070] In some embodiments, the above-mentioned verification of the requester IP and the request signature according to the HTTPS request includes:
[0071] Based on the preset IP whitelist, perform IP verification on the requester according to the HTTPS request;
[0072] Based on the request signing key, the request signature is verified according to the HTTPS request.
[0073] In some embodiments, obtaining the above preset IP whitelist includes:
[0074] In response to the application request sent by the original service, the signature key configures the IP address of the original service as a whitelist in the low-security network Netty scheduling service.
[0075] In some embodiments, after performing the requester IP verification and the request signature verification according to the HTTPS request, the method further includes:
[0076] Perform request format verification and data verification based on HTTPS requests.
[0077] In some embodiments, the HTTPS request includes a signed request header, a defined Content-Type, a requested target address, a requested target path, a request mode of a target service, and a request method of a target service.
[0078] Specifically, the original service with transmission requirements applies for a request signature key from the low-security network Netty scheduling service, and configures the IP address of the original service as a whitelist in the low-security network Netty scheduling service. The original service makes an HTTPS request according to the provided standardized interface document, and the request includes but is not limited to a signature request header, a limited Content-Type, a requested target address, a requested target path, a request method for the target service, and a request method for the target service. Upon receiving the request, the low-security network Netty scheduling service first verifies the requester's IP, verifies the request signature after passing, and finally verifies the request format and data. Requests that fail to pass directly respond with failure information. The low-security network Netty scheduling service converts HTTPS requests into fixed-format data messages and files according to different data types, so that the message data can be safely ferryed to the high-level network through the RabbitMQ message queue and FTP file system provided by the one-way transmission device, and self-loops to check the monitored response messages.
[0079] In box 320, RabbitMQ is an open source message broker software that implements the Advanced Message Queuing Protocol (AMQP). The message queue can realize asynchronous communication, load balancing and decoupling in a distributed system. In the one-way data transmission between high and low security level networks, RabbitMQ can be selected for one-way transmission of structured data to ensure the reliability and real-time performance of data transmission.
[0080] It should be noted that in the one-way data transmission between high and low security level networks, the specific advantages of choosing RabbitMQ for one-way transmission of structured data can be explained from the two aspects of security authentication and network decoupling.
[0081] Specifically, in terms of security authentication, RabbitMQ supports a variety of security mechanisms, including TLS / SSL encryption, to ensure that messages will not be stolen or tampered with when transmitted in the network; RabbitMQ's access control mechanism limits the client's access rights through usernames and passwords, and further enhances security in combination with the signature authentication mechanism; you can set the message's survival time, queue persistence and other features to ensure the reliability of message delivery and data integrity. In terms of network decoupling, RabbitMQ, as a message queue system, naturally has decoupling characteristics; the sender (producer) and the receiver (consumer) do not communicate directly, and the message is delivered by RabbitMQ as an intermediary, enabling the system to run in an asynchronous and distributed environment, reducing the transmission pressure of the network gate; regardless of the network conditions, the producer can send the data to the RabbitMQ queue first, and the consumer can consume the data after the network is restored or the system is ready, ensuring the fault tolerance and elasticity of the system. In summary, in the one-way data transmission between high and low security level networks, RabbitMQ is chosen for one-way transmission of structured data. RabbitMQ ferries structured data between the two networks, which not only ensures the reliability of message transmission and data integrity, but also avoids direct dependence between the two ends. The data is stored and buffered in RabbitMQ, realizing cross-network data flow without being restricted by coupling between networks.
[0082] In some embodiments, the File Transfer Protocol (FTP) is a standard protocol for transferring files over a network, and allows users to upload and download files, and supports user authentication and transfer control. In one-way data transmission between high and low security level networks, FTP can be selected for one-way transmission of unstructured data (such as files) to ensure data integrity and security.
[0083] It should be noted that in the one-way data transmission between high and low security level networks, the specific advantages of choosing to use FTP for one-way transmission of unstructured data can be explained from the two aspects of security authentication and network decoupling.
[0084] Specifically, in terms of security authentication, the FTP protocol provides a transmission encryption function through FTPS (FTP over SSL / TLS) to ensure the security of files in network transmission. Even if the file transmission spans multiple networks, it can ensure that its content will not be intercepted or modified by unauthorized users; FTP file transmission has an additional identity authentication mechanism to ensure that the file is sent and received by the authorized client. In terms of network decoupling, FTP provides a file storage method during data transmission, allowing the sender to upload the file to the FTP server, and the receiver can download the file at an appropriate time. The two do not need to be online or connected in real time at the same time, and the coupling between systems is greatly reduced; FTP is suitable for transmitting large files or unstructured data (such as logs, pictures, videos, etc.). In summary, in the one-way data transmission between high and low security level networks, FTP is chosen for one-way transmission of unstructured data. FTP transmits these data through the network gate, which not only ensures the security of files in network transmission, but also enables the receiver to process files asynchronously, further decoupling the direct communication between the application system and the network.
[0085] In box 330, the high-security network Netty scheduling service monitors the message queue and obtains real-time messages, parses the request message according to a fixed format, obtains the corresponding file from FTP for unstructured request data, and initiates a request to the target service.
[0086] In some embodiments, the low-security-level network Netty scheduling service and the high-security-level network Netty scheduling service are internally encapsulated with an HTTPS interface for converting HTTPS requests into data messages and files in a fixed format according to different data types.
[0087] In some embodiments, HTTPS (Hypertext Transfer Protocol Secure) provides encryption and authentication functions by adding an SSL / TLS layer on top of HTTP to ensure confidentiality and integrity of data during transmission. Based on the HTTPS interface, request header signature is a security mechanism that authenticates the request and verifies data integrity by adding signature information to the HTTP request header. Based on this, the request header signature mechanism is used to ensure the security of network requests, and the HTTPS request is converted into a message or file for one-way transmission according to the request format.
[0088] It should be noted that in one-way data transmission between high- and low-security level networks, the specific advantages of choosing to use HTTPS and request header signatures can be explained from the perspective of security authentication.
[0089] Specifically, in terms of security authentication, HTTPS uses SSL / TLS encryption to ensure the confidentiality of data during transmission, preventing data in transmission from being eavesdropped or tampered with. Compared with ordinary HTTP, HTTPS can provide strong security guarantees. Furthermore, based on the HTTPS interface, the use of the request header signature mechanism, combined with HTTPS's identity authentication and encryption, can further enhance the security of data transmission. Each request is signed and encrypted to ensure the identity of both parties in communication is reliable and prevent man-in-the-middle attacks.
[0090] In some embodiments, the low security level network Netty scheduling service is deployed in the low security level network, and the high security level network Netty scheduling service is deployed in the high security level network; the RabbitMQ message queue and the FTP file system are deployed in physical isolation.
[0091] In block 340 , the high-security-level network Netty dispatch service receives the response from the target service and converts the response data into data messages and files in a fixed format according to different data types.
[0092] In block 350 , after receiving the response from the target service, the high-security-level network Netty dispatch service converts the response data in the same manner as described above and transmits the data through RabbitMQ and FTP.
[0093] In box 360, through the Netty scheduling service deployed in the high and low security level networks, and the RabbitMQ message queue and FTP file provided by the one-way transmission device, the target service transmits the response data to the original service with transmission requirements, thereby realizing one-way data transmission between high and low security level networks.
[0094] In some embodiments, the above method further comprises:
[0095] The low-security-level network Netty scheduling service receives response data corresponding to the unique number from the RabbitMQ message queue and / or FTP file in a self-loop.
[0096] In some embodiments, after the low-security-level network Netty service receives a response message corresponding to the unique number in the self-loop, it converts the message into an HTTP response and returns it to the original service.
[0097] It should be noted that in the one-way data transmission between high and low security level networks, Netty is chosen as a bridge because it is a high-performance asynchronous event-driven network framework. In this disclosure, it serves as a bridge between RabbitMQ, FTP and application services, responsible for encapsulating the underlying data into HTTP requests or responses. Under this architecture, Netty not only improves the transmission efficiency, but also simplifies the integration of the system. The application layer only needs to process HTTP requests without directly interacting with RabbitMQ or FTP. At the same time, the choice of using Netty for data format conversion is based on the fact that Netty can realize the encapsulation and conversion of RabbitMQ messages and FTP files. It converts the structured data or FTP files in the message queue into HTTP data packets after being processed by Netty, so that the systems at both ends can communicate through the general protocol HTTP without having to worry about the specific transmission implementation at the bottom.
[0098] According to the embodiments of the present disclosure, the following technical effects are achieved:
[0099] It can receive HTTPS requests sent by the original service through the Netty scheduling service of the low-security network, perform requester IP verification and request signature verification based on the HTTPS request, and convert HTTPS requests into fixed-format data messages and files according to different data types; RabbitMQ message queue, receive structured HTTPS requests sent by the Netty scheduling service of the low-security network and send them to the high-security network; FTP file, receive unstructured HTTPS requests sent by the Netty scheduling service of the low-security network and send them to the high-security network; high-security network Netty scheduling service, listen to the RabbitMQ message queue and obtain structured HTTPS requests and send them to the target service, obtain unstructured HTTPS requests from FTP files and send them to the target service; high-security network Netty scheduling service, receive response data sent by the target service, and convert the response data according to Different data types are converted into data messages and files in fixed formats; RabbitMQ message queue receives structured response data sent by Netty scheduling service of high security level network and sends it to low security level network; FTP file receives unstructured response data sent by Netty scheduling service of high security level network and sends it to low security level network; Netty scheduling service of low security level network listens to RabbitMQ message queue and obtains structured response data and converts it into HTTP response and sends it to original service, obtains unstructured response data from FTP file and converts it into HTTP response and sends it to original service; based on this, by encapsulating one-way transmission mode, Netty network scheduling framework is introduced to provide standardized communication interface to the outside world, combined with RabbitMQ message queue and FTP file transfer technology, so that business system can perform data transmission imperceptibly, providing a more flexible and secure one-way data transmission solution. Specifically, unified interface: through standardized communication interface, the integration process of business system is simplified, and the development and maintenance costs are reduced; enhanced security: using request header signature and whitelist mechanism to ensure that only authorized data can be transmitted, ensuring the security and legality of data transmission, and improving system security; efficient real-time monitoring: using Netty's high-performance network scheduling capabilities, as well as the combination of message queues and FTP, real-time monitoring of data transmission status to ensure the real-time and reliability of data; multiple data type support: supporting the transmission of structured data and unstructured data to meet the transmission requirements of different types of data. In summary, through the above technical solutions, a safe, reliable and efficient solution is provided for data transmission between high-security level networks and low-security level networks, which improves the security and ease of use of data transmission.
[0100] Figure 4FIG. 4 is a flowchart of another method 400 for unidirectional data transmission between networks with high and low security levels according to an embodiment of the present disclosure. The method 400 may be Figure 1 The one-way data transmission system 104 between high and low security level networks is executed.
[0101] In some embodiments, the low-security network Netty scheduling service receives the request data sent by the original service, that is, the HTTPS request; based on the standard HTTPS interface, the request data is filtered by the IP blacklist; if it is not satisfied, a response will be returned; if it is satisfied, the request signature verification is performed on the request data; if it fails, a response will be returned; if it is satisfied, the data is converted according to the request type of the request data, and the structured data is sent to the RabbitMQ message queue, and the unstructured data is sent to the FTP file. The high-security network Netty scheduling service listens to the message queue message and converts the data according to the message type; for the unstructured type, the unstructured data is converted from the FTP pull file into a data stream; for the structured type, the structured data is converted into HTTP standard data; the data stream and / or HTTP standard data is forwarded to the target service, and the response data of the target service is received, and the response is converted into a queue message and forwarded to the RabbitMQ message queue. The low-security network Netty scheduling service listens to the RabbitMQ message queue message, polls and waits for the response so as to send the response data to the original service, and returns the response.
[0102] From the above, it can be seen that compared with the current one-way transmission equipment that usually requires customized interfaces, which increases the complexity of system integration and maintenance, the present disclosure adopts the Netty scheduling framework to provide a standardized HTTPS interface, so that the business system can perform data transmission without perception. Compared with the current one-way transmission equipment, which has limited support for data formats, especially the inability to effectively meet the transmission requirements of unstructured data, this application converts HTTPS requests into RabbitMQ messages or FTP files to achieve one-way transmission of structured data and unstructured data. Compared with the current one-way transmission equipment that usually directly faces the docking of application systems, and the security mechanism is relatively simple, lacking flexible and powerful authentication and authorization functions, this application cuts off the one-way transmission equipment from directly facing the application system, and increases the authentication and authorization capabilities to make data transmission more secure.
[0103] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all described as a series of action combinations, but those skilled in the art should be aware that the present disclosure is not limited by the order of the actions described, because according to the present disclosure, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all optional embodiments, and the actions and modules involved are not necessarily required by the present disclosure.
[0104] The above is an introduction to the method embodiment. The following is a further explanation of the scheme disclosed in the present invention through an apparatus embodiment.
[0105] Figure 5 FIG. 5 shows a block diagram of a high- and low-security-level network unidirectional data transmission device 500 according to an embodiment of the present disclosure. The device 500 may be included in Figure 1 The high-low security level network unidirectional data transmission system 104 is implemented as the high-low security level network unidirectional data transmission system 104. Figure 5 As shown, the device 500 includes:
[0106] The low-security-level network Netty scheduling service module 510 is used to receive the HTTPS request sent by the original service and perform requester IP verification and request signature verification according to the HTTPS request, and is also used to convert the HTTPS request into a fixed-format data message and file according to different data types;
[0107] RabbitMQ message queue module 520, used to receive structured HTTPS requests sent by Netty scheduling service of low security level network and send them to high security level network; FTP file module 530, used to receive unstructured HTTPS requests sent by Netty scheduling service of low security level network and send them to high security level network;
[0108] A high-security network Netty scheduling service module 540 is used to monitor the RabbitMQ message queue and obtain structured HTTPS requests and send them to the target service, and is also used to obtain unstructured HTTPS requests from FTP files and send them to the target service;
[0109] The high-security network Netty scheduling service module 540 is also used to receive response data sent by the target service, and is also used to convert the response data into fixed-format data messages and files according to different data types;
[0110] The RabbitMQ message queue module 520 is also used to receive the structured response data sent by the Netty scheduling service of the high security level network and send it to the low security level network; the FTP file module 530 is also used to receive the unstructured response data sent by the Netty scheduling service of the high security level network and send it to the low security level network;
[0111] The low security level network Netty scheduling service module 510 is also used to monitor the RabbitMQ message queue and obtain structured response data and convert it into HTTP response and send it to the original service. It is also used to obtain unstructured response data from FTP files and convert it into HTTP response and send it to the original service.
[0112] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0113] In the technical solution disclosed herein, the acquisition, storage and application of user personal information involved are in compliance with the provisions of relevant laws and regulations and do not violate public order and good morals.
[0114] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.
[0115] Figure 6 A block diagram of an exemplary electronic device 600 capable of implementing an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or claimed herein.
[0116] The electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a ROM 602 or a computer program loaded from a storage unit 608 into a RAM 603. In the RAM 603, various programs and data required for the operation of the electronic device 600 can also be stored. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An I / O interface 605 is also connected to the bus 604.
[0117] Multiple components in the electronic device 600 are connected to the I / O interface 605, including: an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0118] The computing unit 601 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as method 300. For example, in some embodiments, the method 300 may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 608.
[0119] In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the method 300 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to execute the method 300 in any other appropriate manner (e.g., by means of firmware).
[0120] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0121] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0122] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0123] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).
[0124] The systems and techniques described herein may be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.
[0125] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship of client and server is generated by computer programs running on respective computers and having a client-server relationship with each other. The server may be a cloud server, a server of a distributed system, or a server combined with a blockchain.
[0126] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.
[0127] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.
Claims
1. A method for unidirectional data transmission between networks with high and low security levels, characterized in that: include: The low-security network Netty scheduling service receives the HTTPS request sent by the original service and performs requester IP verification and request signature verification according to the HTTPS request, and converts the HTTPS request into a fixed-format data message and file according to different data types; RabbitMQ message queue, receiving the structured HTTPS request sent by the Netty scheduling service of the low security level network and sending it to the high security level network; FTP file, receiving the unstructured HTTPS request sent by the Netty scheduling service of the low security level network and sending it to the high security level network; A high-security network Netty scheduling service monitors the RabbitMQ message queue and obtains structured HTTPS requests and sends them to the target service, obtains unstructured HTTPS requests from the FTP file and sends them to the target service; The high-security-level network Netty scheduling service receives the response data sent by the target service and converts the response data into data messages and files in fixed formats according to different data types; The RabbitMQ message queue receives the structured response data sent by the Netty scheduling service of the high security level network and sends it to the low security level network; the FTP file receives the unstructured response data sent by the Netty scheduling service of the high security level network and sends it to the low security level network; The low-security-level network Netty scheduling service monitors the RabbitMQ message queue and obtains structured response data and converts it into HTTP response and sends it to the original service, obtains unstructured response data from the FTP file and converts it into HTTP response and sends it to the original service.
2. The method according to claim 1, characterized in that The low-security-level network Netty scheduling service and the high-security-level network Netty scheduling service are internally encapsulated with an HTTPS interface for converting HTTPS requests into data messages and files in a fixed format according to different data types.
3. The method according to claim 1, characterized in that The performing requester IP verification and request signature verification according to the HTTPS request includes: Based on the preset IP whitelist, perform IP verification of the requester according to the HTTPS request; Based on the request signing key, a request signature verification is performed according to the HTTPS request.
4. The method according to claim 3, characterized in that The acquisition of the preset IP whitelist includes: In response to the application request signing key sent by the original service, the low-security level network Netty scheduling service configures the IP address of the original service as a whitelist.
5. The method according to claim 3, characterized in that: After performing requester IP verification and request signature verification according to the HTTPS request, the method further includes: Request format verification and data verification are performed according to the HTTPS request.
6. The method according to claim 1, characterized in that The HTTPS request includes a signed request header, a limited Content-Type, a requested target address, a requested target path, a request mode of the target service, and a request method of the target service.
7. The method according to any one of claims 1 to 6, characterized in that: The method further comprises: The low-security-level network Netty scheduling service receives the response data of the unique number corresponding to the RabbitMQ message queue and / or the FTP file in a self-loop.
8. A unidirectional data transmission device between high and low security level networks, characterized in that: include: The low-security network Netty scheduling service module is used to receive the HTTPS request sent by the original service and perform requester IP verification and request signature verification according to the HTTPS request, and is also used to convert the HTTPS request into a fixed-format data message and file according to different data types; A RabbitMQ message queue module is used to receive the structured HTTPS request sent by the Netty scheduling service of the low-security level network and send it to the high-security level network; an FTP file module is used to receive the unstructured HTTPS request sent by the Netty scheduling service of the low-security level network and send it to the high-security level network; A high-security network Netty scheduling service module, used to monitor the RabbitMQ message queue and obtain structured HTTPS requests and send them to the target service, and also used to obtain unstructured HTTPS requests from the FTP file and send them to the target service; The high-security-level network Netty scheduling service module is also used to receive response data sent by the target service, and is also used to convert the response data into data messages and files in a fixed format according to different data types; The RabbitMQ message queue module is further used to receive the structured response data sent by the Netty scheduling service of the high security level network and send it to the low security level network; the FTP file module is further used to receive the unstructured response data sent by the Netty scheduling service of the high security level network and send it to the low security level network; The low-security-level network Netty scheduling service module is also used to monitor the RabbitMQ message queue and obtain structured response data and convert it into HTTP response and send it to the original service, and is also used to obtain unstructured response data from the FTP file and convert it into HTTP response and send it to the original service.
9. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively coupled to the at least one processor; The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 7.
10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to cause the computer to execute the method according to any one of claims 1-7.