Trusted heterogeneous redundant dual-channel data security connection system and method

Abstract

The invention belongs to the technical field of network space security, and particularly relates to a data security connection system and method. Aiming at network security risks caused by cross-network and cross-domain data connection, a trusted heterogeneous redundant dual-channel data security connection system is designed and comprises a sender external connection access subsystem, a boundary protection subsystem, an isolation exchange subsystem, an isolation buffer subsystem, a receiver external connection access subsystem and an operation and maintenance management subsystem, according to the system, through a multi-layer isolation heterogeneous buffer design and a multi-root-of-trust trust chain transfer design, the depth defense capability of a connection system is enhanced, the homomorphic network breaking problem is avoided, and through a dual-channel redundancy design, the system reliability is improved, and the application scene adaptation degree is improved.

Description

Technical Field

[0001] The present invention belongs to the field of cyberspace security technology, and in particular relates to a trusted heterogeneous redundant dual-channel data security connection system and method. Background Art

[0002] In the information age, ensuring data security and efficient sharing is a key link. The demand for data cross-network and cross-domain secure connection has become very urgent. However, data information cross-network and cross-domain connection may face network attacks such as phishing attacks, man-in-the-middle attacks, DDOS attacks, virus attacks, and social engineering. Once the attacker breaks into a high-security network from a low-security network, it will bring immeasurable consequences. Faced with the security risks that may be brought about by data cross-network and cross-domain connection, how to achieve data cross-network and cross-domain secure connection is an issue that needs to be solved urgently. Summary of the invention

[0003] The purpose of the present invention is to provide a trusted heterogeneous redundant dual-channel data security connection system and method to solve the security risks existing in cross-network and cross-domain data security connection and reduce the risk of the system being breached by network attacks.

[0004] The technical solution of the present invention is:

[0005] 1. A trusted heterogeneous redundant dual-channel data security access system, characterized by comprising: a sender external access subsystem, an isolation exchange subsystem, an isolation buffer subsystem, and a receiver external access subsystem; wherein:

[0006] The sender external access subsystem includes a sender trusted computer;

[0007] The isolation exchange subsystem includes a first trusted data exchange gateway and a first unidirectional isolator;

[0008] The isolation buffer subsystem includes a trusted isolation buffer gateway, a second unidirectional isolator, a third unidirectional isolator, and a second trusted data exchange gateway;

[0009] The receiver's external access subsystem includes the receiver's trusted computer;

[0010] Along the data transmission direction, the data transmission link is from the sender's trusted computer to the first trusted data exchange gateway, to the first unidirectional isolator, to the trusted isolation buffer gateway, to the second unidirectional isolator or the third unidirectional isolator, to the second trusted data exchange gateway, to the receiver's trusted computer;

[0011] The first unidirectional isolator, the second unidirectional isolator, and the third unidirectional isolator are heterogeneous unidirectional isolators, including a transmitting end, a unidirectional channel, and a receiving end, wherein the transmitting end is used to receive data and perform private protocol encapsulation on the received data, the unidirectional channel is used to transmit the private protocol encapsulated data to the receiving end in a single direction, and the receiving end is used to receive data and send the data;

[0012] The sender's trusted computer, the receiver's trusted computer, the first trusted data exchange gateway, the trusted isolation buffer gateway, and the second trusted data exchange gateway all have built-in trusted roots; between the sender's trusted computer and the first trusted data exchange gateway, between the first trusted data exchange gateway and the trusted isolation buffer gateway, between the trusted isolation buffer gateway and the second trusted data exchange gateway, and between the second trusted data exchange gateway and the receiver's trusted computer, trusted interconnection authentication of the communicating parties is performed based on the trusted root, so as to realize the security and reliability of the data security interface system.

[0013] Furthermore, the sender's trusted computer, the receiver's trusted computer, the first trusted data exchange gateway, the trusted isolation buffer gateway, and the second trusted data exchange gateway are configured with a trusted security management module, and the trusted security management module is used to implement trusted interconnection authentication and trusted measurement of the communicating parties. The trusted interconnection authentication is used for identity authentication of the communicating parties, and the trusted measurement measures its own trusted state.

[0014] Furthermore, the sender's trusted computer, the first trusted data exchange gateway, the trusted isolation buffer gateway, and the second trusted data exchange gateway are also configured with a data trusted exchange module, which is used to process the received data according to the trusted measurement results of the trusted security management modules configured by each of them; when the trusted measurement results are trusted, the data is encrypted, protected in terms of integrity, and protected in terms of digital signature, and a trusted identifier, a delay identifier, and a data size identifier are added to form a special format and sent to the next level; when the result is untrustworthy, the received data is discarded; the receiver's trusted computer is configured with a data trusted exchange module, and when the trusted measurement results of the trusted security management module configured by itself are trusted, the received data is integrity checked and digitally signed, and after the verification is passed, the received data is decrypted and restored to plaintext data; when the result is untrustworthy, the received data is discarded.

[0015] Furthermore, the first unidirectional isolator, the second unidirectional isolator, and the third unidirectional isolator are of different types: optical shutter type isolation, photoelectric type isolation, and mechanical type isolation.

[0016] Furthermore, the data trusted exchange module performs a format check and a trusted identification check on the received data before processing the received data according to the trusted measurement results of the trusted security management module of the subsystem in which it is located; if the format check and the trusted identification check fail, the received data is discarded; if the format check and the trusted identification check pass, the received data is processed according to the trusted interconnection authentication and trusted measurement results of the trusted security management module of the subsystem in which it is located.

[0017] Furthermore, it also includes an operation and maintenance management subsystem, which is used to uniformly manage the operating status of the sender's external access subsystem, boundary protection subsystem, isolation switching subsystem, isolation buffer subsystem, and the receiver's external access subsystem, as well as the data transmission status, and provide task-level full-process log auditing. The audit elements include: task occurrence time, sending subject, receiving subject, path nodes, data size, and time.

[0018] Furthermore, the first unidirectional isolator selects an optical gate type unidirectional isolator; the second unidirectional isolator selects a photoelectric type unidirectional isolator, and the third unidirectional isolator selects a mechanical type unidirectional isolator; the trusted isolation buffer gateway is configured with a transmission link allocation module, which selects the data link of the second unidirectional isolator or the third unidirectional isolator according to the delay identifier and data size identifier of the received data, and sends data with a small transmission data volume and high delay requirements to the second unidirectional isolator; data with a large transmission data volume and low delay requirements are sent to the third unidirectional isolator.

[0019] Furthermore, it also includes a boundary protection subsystem, which is arranged between the sender's external access subsystem and the isolation switching subsystem, and is used to perform network isolation, access control, attack behavior monitoring, and malicious code detection security protection on the boundary between the sender's external access subsystem and the isolation switching subsystem; the trusted security management module also includes a trusted reporting function, which alarms when an untrustworthy situation is found.

[0020] A trusted heterogeneous redundant dual-channel data secure connection method is characterized by using a trusted heterogeneous redundant dual-channel data secure connection system as described above to perform full-link trusted interconnection authentication and secure and reliable transmission of connection data, and specifically performing the following steps:

[0021] A. System Initialization

[0022] Based on the operation and maintenance management subsystem, the sender's external access subsystem, the isolation exchange subsystem, the isolation buffer subsystem, and the receiver's external access subsystem are initialized and configured in an out-of-band manner, the operating status and data exchange behavior of each subsystem are monitored in real time, and a task-level full-process log audit is performed; the sender's trusted computer, the receiver's trusted computer, the first trusted data exchange gateway, the trusted isolation buffer gateway, and the second trusted data exchange gateway initialize the trusted state and generate their own initial measurement values; the sender's trusted computer sends its own authentication object information as the original authentication object information to the first trusted data exchange gateway, and the first trusted data exchange gateway stores the received original authentication object information of the sender's trusted computer in the trusted root; the first trusted The data exchange gateway sends its own authentication object information as original authentication object information to the trusted isolation buffer gateway, and the trusted isolation buffer gateway stores the received original authentication object information of the first trusted data exchange gateway in the trusted root; the trusted isolation buffer gateway sends its own authentication object information as original authentication object information to the second trusted data exchange gateway, and the second trusted data exchange gateway stores the received original authentication object information of the trusted isolation buffer gateway in the trusted root; the second trusted data exchange gateway sends its own authentication object information as original authentication object information to the receiving party's trusted computer, and the receiving party's trusted computer stores the received original authentication object information of the second trusted data exchange gateway in the trusted root;

[0023] B. Full-link trusted interconnection authentication

[0024] The data trusted exchange module of the sender's trusted computer detects whether there is access data; when there is data that needs to be accessed, the trusted computer of the sender and the first trusted data exchange gateway, the first trusted data exchange gateway and the trusted isolation buffer gateway, the trusted isolation buffer gateway and the second trusted data exchange gateway, and the second trusted data exchange gateway and the receiver's trusted computer start trusted interconnection authentication based on the trusted root, and the process is as follows:

[0025] B1. Trusted interconnection authentication between the sender's trusted computer and the first trusted data exchange gateway: the trusted security management module of the sender's trusted computer sends authentication object information to the trusted security management module of the first trusted data exchange gateway, and the trusted security management module of the first trusted data exchange gateway compares the received authentication object information of the sender's trusted computer with the original authentication object information of the sender's trusted computer stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the sender's trusted computer establishes a communication connection with the first trusted data exchange gateway, and executes step B2 to start the trusted interconnection authentication between the first trusted data exchange gateway and the trusted isolation buffer gateway;

[0026] B2. Trusted interconnection authentication between the first trusted data exchange gateway and the trusted isolation buffer gateway: the trusted security management module of the first trusted data exchange gateway sends authentication object information to the trusted security management module of the trusted isolation buffer gateway, and the trusted security management module of the trusted isolation buffer gateway receives the authentication object information of the first trusted data exchange gateway and compares it with the original authentication object information of the first trusted data exchange gateway stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the first trusted data exchange gateway establishes a communication connection with the trusted isolation buffer gateway, and executes step B3 to start the trusted interconnection authentication between the trusted isolation buffer gateway and the second trusted data exchange gateway;

[0027] B3. Trusted interconnection authentication between the trusted isolation buffer gateway and the second trusted data exchange gateway: the trusted security management module of the trusted isolation buffer gateway sends authentication object information to the trusted security management module of the second trusted data exchange gateway; the trusted security management module of the second trusted data exchange gateway receives the authentication object information of the trusted isolation buffer gateway, and compares it with the original authentication object information of the trusted isolation buffer gateway stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the trusted isolation buffer gateway establishes a communication connection with the second trusted data exchange gateway, and executes B4 to start the trusted interconnection authentication between the second trusted data exchange gateway and the receiving trusted computer;

[0028] B4. Trusted interconnection authentication between the second trusted data exchange gateway and the recipient's trusted computer: the trusted security management module of the second trusted data exchange gateway sends authentication object information to the trusted security management module of the recipient's trusted computer; the trusted security management module of the recipient's trusted computer receives the authentication object information of the second trusted data exchange gateway and compares it with the original authentication object information of the second trusted data exchange gateway stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the second trusted data exchange gateway establishes a communication connection with the recipient's trusted computer;

[0029] C. The trusted security management module in the trusted computer of the receiving party notifies the trusted data exchange module in the trusted computer of the sending party in an out-of-band manner that "the trusted channel is ready"; the trusted data exchange module in the trusted computer of the sending party executes step D to initiate data transmission;

[0030] D. Connect data for data communication

[0031] D1. The data trusted exchange module configured by the sender's trusted computer performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module configured by itself; when the trusted measurement result is trusted, the data is encrypted, protected in integrity, and protected by a digital signature, and a trusted identification, delay identification, and data size identification are added to form a special format, which is then sent to the data trusted exchange module configured by the first trusted data exchange gateway after passing the security protection of the boundary protection subsystem, and step D2 is executed; when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0032] D2. When the data trusted exchange module configured by the first trusted data exchange gateway finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the data is encrypted, protected in integrity, and protected by a digital signature, and a trusted identification, delay identification, and data size identification are added to form a special format and sent to the first unidirectional isolator; the first unidirectional isolator performs private protocol encapsulation on the received data and sends it to the data trusted exchange module configured by the trusted isolation buffer proxy gateway; when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0033] D3. When the data trusted exchange module configured by the trusted isolation buffer proxy gateway finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the data is encrypted, integrity protected, and digitally signed, and a trusted identification, delay identification, and data size identification are added to form a special format and sent to the transmission link allocation module configured by itself; the transmission link allocation module selects data to be sent to the second unidirectional isolator or the third unidirectional isolator according to the delay identification and data size identification of the received data; data with a small amount of transmission data and a high delay requirement are sent to the second unidirectional isolator; data with a large amount of transmission data and a low delay requirement are sent to the third unidirectional isolator; the second unidirectional isolator or the third unidirectional isolator performs a private protocol encapsulation on the received data and sends it to the data trusted exchange module configured by the second trusted data exchange gateway; when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0034] D4. When the data trusted exchange module configured by the second trusted data exchange gateway finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the data is encrypted, protected by integrity, and protected by digital signature, and a trusted identification, delay identification, and data size identification are added to form a special format and sent to the data trusted exchange module configured by the receiving party's trusted computer; when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0035] D5. When the data trusted exchange module configured in the trusted computer of the receiving party finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the return is returned to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the received data is checked for integrity and verified for digital signature, and after the verification passes, the received data is decrypted and restored to plaintext data, and the connection data communication is completed; when the trusted measurement result is untrustworthy, the received data is discarded and the return is returned to step B.

[0036] Advantages of the present invention: The trusted heterogeneous redundant dual-channel data security connection method described in the present invention has four advantages:

[0037] First, by deploying multiple layers of buffer zones, we can increase the system's defense barriers, expand the depth of defense, make it more difficult for the system to be invaded by the network, and significantly reduce the risk of the system being breached by a network attack.

[0038] Second, in order to solve the problem of homogeneous failure, heterogeneous buffers are designed. That is, through differentiated and systematic deployment of data exchange gateways, buffer proxy gateways, and multiple one-way isolators, different types of protection methods can be distinguished to further confuse and deceive attackers, making it impossible for them to continuously break into the network with the same method.

[0039] Third, based on trusted computing technology, we can achieve trusted interconnection between cross-network and cross-domain devices, pass trust level by level, establish a secure channel for the entire link, and achieve "build a trusted path first and then transmit trusted data";

[0040] Fourth, in response to different performance requirements, dual channels are designed around the two core indicators of "delay" and "data size". On the one hand, the reliability of the system is improved, and on the other hand, differentiated design is used to better meet application needs, reducing the situation where large data volume tasks occupy the optoelectronic isolation channel for a long time, while small data volume tasks blindly use the mechanical isolation channel to increase unnecessary delays. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 It is a structural diagram of a trusted heterogeneous redundant dual-channel data security access system; wherein 1-sender external access subsystem, 2-boundary protection subsystem, 3-isolation exchange subsystem, 4-isolation buffer subsystem, 5-receiver external access subsystem, 11-sender trusted computer 1, 31-first trusted data exchange gateway, 32-first unidirectional isolator, 41-trusted isolation buffer gateway, 42-second unidirectional isolator, 43-third unidirectional isolator, 44 second trusted data exchange gateway, 51-receiver trusted computer, in addition, the figure also has a trusted security management module, a data trusted exchange module, and a transmission link allocation module DETAILED DESCRIPTION

[0042] Embodiment 1:

[0043] like Figure 1 As shown, a trusted heterogeneous redundant dual-channel data security access system is characterized by comprising: a sender external access subsystem (1), a boundary protection subsystem (2), an isolation exchange subsystem (3), an isolation buffer subsystem (4), a receiver external access subsystem (5), and an operation and maintenance management subsystem (6); wherein:

[0044] The sender external access subsystem (1) comprises a sender trusted computer (11);

[0045] The isolation exchange subsystem (3) comprises a first trusted data exchange gateway (31) and a first unidirectional isolator (32);

[0046] The isolation buffer subsystem (4) comprises a trusted isolation buffer gateway (41), a second unidirectional isolator (42), a third unidirectional isolator (43), and a second trusted data exchange gateway (44);

[0047] A receiver external access subsystem (5), including a receiver trusted computer (51);

[0048] Along the data transmission direction, the data transmission link is sequentially from the sender trusted computer (11) to the boundary protection subsystem (2), to the first trusted data exchange gateway (31), to the first unidirectional isolator (32), to the trusted isolation buffer gateway (41), to the second unidirectional isolator (42) or the third unidirectional isolator (43), to the second trusted data exchange gateway (44), to the receiver trusted computer (51);

[0049] The first unidirectional isolator (32), the second unidirectional isolator (42), and the third unidirectional isolator (43) are heterogeneous unidirectional isolators (heterogeneous unidirectional isolators refer to the three being of different types, and unidirectional refers to the data being transmitted from a low security level to a high security level), comprising a sending end, a unidirectional channel, and a receiving end, wherein the sending end is used to receive data and perform private protocol encapsulation on the received data, and then transmit the data to the receiving end in a single direction through the unidirectional channel, and the receiving end forwards the data to the outside of the isolator after receiving the data;

[0050] The sender's trusted computer (11), the receiver's trusted computer (51), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) all have built-in trusted roots; between the sender's trusted computer (11) and the first trusted data exchange gateway (31), between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41), between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44), and between the second trusted data exchange gateway (44) and the receiver's trusted computer (51), the trusted interconnection authentication of the two communicating parties is performed based on the trusted root to build a secure and trusted hardware and software environment for the entire channel. The trusted root is a module for establishing and guaranteeing a trusted source point, and is used for the trusted interconnection authentication and trusted measurement of the received data by the device (computer, gateway). The trusted root is a module for establishing and guaranteeing a trusted source point, and is used to support the trusted interconnection authentication of the received data by the device (computer, gateway) and the trusted measurement of the device's (computer, gateway) own hardware and software environment.

[0051] The sender's trusted computer (11), the receiver's trusted computer (51), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) are configured with a trusted security management module; the trusted security management module is used to implement the trusted interconnection authentication and trusted measurement of the two communicating parties, and to draw a conclusion on whether the two communicating parties are trusted. Among them, the trusted interconnection authentication refers to the trusted authentication initiated by the data sender to the data receiver before the data is transmitted. The objects of the trusted authentication include device IP / MAC level authentication, device firmware information and serial number and other built-in credential authentication and device trusted status authentication; the trusted status is a trusted measurement value generated based on the built-in trusted root of the device (computer, gateway); the trusted measurement is a process of calculating the security of the hardware and software environment of the device (computer, gateway) based on the measurement algorithm (such as MD5, SHA1, etc.) provided by the trusted root, and the calculation result obtained by the trusted measurement is the trusted measurement value.

[0052] The sender's trusted computer (11), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) are also configured with a data trusted exchange module, which is used to process the received data according to the trusted measurement results of the trusted security management module configured by each of them; when the trusted measurement result is trusted, the data is encrypted, protected in integrity, and protected in digital signature, and a trusted identifier, a delay identifier, and a data size identifier are added to form a special format and sent to the next level; when the trusted measurement result is untrustworthy, the received data is discarded; the receiver's trusted computer (51) is configured with a data trusted exchange module, and when the trusted measurement result of the trusted security management module configured by itself is trusted, the received data is integrity checked and digitally signed, and the received data is decrypted and restored to the original data after the verification is passed; when the trusted measurement result is untrustworthy, the received data is discarded. Wherein, the trusted identifier can be generated by combining the data type, confidentiality level, forwarding range, and the trusted measurement value generated by the host trusted security management program, and digital signature protection is performed.

[0053] The first unidirectional isolator (32), the second unidirectional isolator (42), and the third unidirectional isolator (43) are of different types, such as optical gate type isolation, photoelectric type isolation, and mechanical type isolation. An optional method is that the first unidirectional isolator (32) uses an optical gate type unidirectional isolator to make full use of its large data throughput and complete the first isolation handover process as quickly as possible; the second unidirectional isolator (42) uses a photoelectric type unidirectional isolator, and the third unidirectional isolator (43) uses a mechanical type unidirectional isolator; the trusted isolation buffer gateway (41) is equipped with a transmission link allocation module, which selects the data link of the second unidirectional isolator (42) or the third unidirectional isolator (43) according to the delay mark and data size mark of the received data, and sends the data with a small amount of transmission data and a high delay requirement to the second unidirectional isolator (42); the data with a large amount of transmission data and a low delay requirement is sent to the third unidirectional isolator (43).

[0054] The data trusted exchange module performs a format check and a trusted identification check on the received data before processing the received data according to the trusted measurement results of the trusted security management module of the subsystem in which it is located; if the format check and the trusted identification check fail, the received data is discarded; if the format check and the trusted identification check pass, the received data is processed according to the trusted measurement results of the trusted security management module of the subsystem in which it is located.

[0055] The operation and maintenance management subsystem (6) is used for unified management of the operating status and data transmission status of the sender's external access subsystem (1), the boundary protection subsystem (2), the isolation exchange subsystem (3), the isolation buffer subsystem (4), and the receiver's external access subsystem (5), and provides task-level full-process log auditing, wherein the auditing elements include: occurrence time, sender, receiver, path nodes, data size, and time.

[0056] The boundary protection subsystem (2) is used to provide security protection for the boundary between the sender external access subsystem (1) and the isolation exchange subsystem (3), and can adopt a variety of security protection methods such as network isolation, access control, attack behavior monitoring, malicious code detection, etc.

[0057] The trusted security management module also includes a trusted reporting function, which alarms when untrusted data is found.

[0058] Embodiment 2:

[0059] A trusted heterogeneous redundant dual-channel data secure connection method is characterized by using a trusted heterogeneous redundant dual-channel data secure connection system as described in Example 1 to perform full-link trusted interconnection authentication and secure and reliable transmission of connection data, and specifically performing the following steps:

[0060] A. System Initialization

[0061] Based on the operation and maintenance management subsystem, the sender external access subsystem (1), the isolation exchange subsystem (3), the isolation buffer subsystem (4), and the receiver external access subsystem (5) are initialized and configured in an out-of-band manner, the operating status and data exchange behavior of each subsystem are monitored in real time, and a task-level full-process log audit is performed; the sender trusted computer (11), the receiver trusted computer (51), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) perform trusted state initialization and generate respective initial measurement values; the sender trusted computer (11) sends its own authentication object information as original authentication object information to the first trusted data exchange gateway (31), and the first trusted data exchange gateway (31) stores the received original authentication object information of the sender trusted computer (11) in the trusted root; the first trusted The data exchange gateway (31) sends its own authentication object information as original authentication object information to the trusted isolation buffer gateway (41), and the trusted isolation buffer gateway (41) stores the received original authentication object information of the first trusted data exchange gateway (31) in the trusted root; the trusted isolation buffer gateway (41) sends its own authentication object information as original authentication object information to the second trusted data exchange gateway (44), and the second trusted data exchange gateway (44) stores the received original authentication object information of the trusted isolation buffer gateway (41) in the trusted root; the second trusted data exchange gateway (44) sends its own authentication object information as original authentication object information to the receiving trusted computer (51), and the receiving trusted computer (51) stores the received original authentication object information of the second trusted data exchange gateway (44) in the trusted root;

[0062] The authentication object information includes IP / MAC, device firmware information, serial number, and other built-in credential authentication and trusted status.

[0063] B. Full-link trusted interconnection authentication

[0064] The data trusted exchange module of the sender's trusted computer (11) detects whether there is data to be linked; when there is data to be linked, the trusted interconnection authentication is started based on the trusted root between the sender's trusted computer (11) and the first trusted data exchange gateway (31), between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41), between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44), and between the second trusted data exchange gateway (44) and the receiver's trusted computer (51), and the process is as follows:

[0065] B1. Trusted interconnection authentication between the sender's trusted computer (11) and the first trusted data exchange gateway (31): the trusted security management module of the sender's trusted computer (11) sends authentication object information to the trusted security management module of the first trusted data exchange gateway (31), and the trusted security management module of the first trusted data exchange gateway (31) compares the received authentication object information of the sender's trusted computer (11) with the original authentication object information of the sender's trusted computer (11) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the sender's trusted computer (11) establishes a communication connection with the first trusted data exchange gateway (31), and executes B2 to start the trusted interconnection authentication between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41);

[0066] B2. Trusted interconnection authentication between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41): the trusted security management module of the first trusted data exchange gateway (31) sends authentication object information to the trusted security management module of the trusted isolation buffer gateway (41), and the trusted security management module of the trusted isolation buffer gateway (41) receives the authentication object information of the first trusted data exchange gateway (31), and compares it with the original authentication object information of the first trusted data exchange gateway (31) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the first trusted data exchange gateway (31) establishes a communication connection with the trusted isolation buffer gateway (41), and executes B3 to start the trusted interconnection authentication between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44);

[0067] B3. Trusted interconnection authentication between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44): the trusted security management module of the trusted isolation buffer gateway (41) sends authentication object information to the trusted security management module of the second trusted data exchange gateway (44); the trusted security management module of the second trusted data exchange gateway (44) receives the authentication object information of the trusted isolation buffer gateway (41), and compares it with the original authentication object information of the trusted isolation buffer gateway (41) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the trusted isolation buffer gateway (41) establishes a communication connection with the second trusted data exchange gateway (44), and executes B4 to start the trusted interconnection authentication between the second trusted data exchange gateway (44) and the receiving trusted computer (51);

[0068] B4. Trusted interconnection authentication between the second trusted data exchange gateway (44) and the receiving trusted computer (51): the trusted security management module of the second trusted data exchange gateway (44) sends authentication object information to the trusted security management module of the receiving trusted computer (51); the trusted security management module of the receiving trusted computer (51) receives the authentication object information of the second trusted data exchange gateway (44), and compares it with the original authentication object information of the second trusted data exchange gateway (44) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the second trusted data exchange gateway (44) establishes a communication connection with the receiving trusted computer (51);

[0069] (This step is that multiple trusted devices perform full-link trusted interconnection authentication on the entire link. To ensure the continuous credibility of the link between trusted devices, this step is executed every time a data connection task is initiated to perform trusted interconnection authentication on the entire link;)

[0070] C. The trusted security management module in the receiving party's trusted computer (51) notifies the data trusted exchange module in the sending party's trusted computer (11) that "the trusted channel is ready" through an out-of-band method (out-of-band management refers to the transmission of management information through an independent physical channel, which is separated from the data induction channel); the data trusted exchange module in the sending party's trusted computer (11) executes step D to induction data transmission;

[0071] D. Connect data for data communication

[0072] D1. The sender's external access subsystem (1) communicates data with the isolation exchange subsystem (3): the data trusted exchange module configured by the sender's trusted computer (11) performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module configured by itself; when the trusted measurement result is trusted, the data is encrypted, protected in integrity, and protected by a digital signature, and a trusted identification, delay identification, and data size identification are added to form a special format, which is then sent to the data trusted exchange module configured by the first trusted data exchange gateway (31) after passing the security protection of the boundary protection subsystem (2), and step D2 is executed; when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0073] D2. The isolation exchange subsystem (3) communicates data to the isolation buffer subsystem (4):

[0074] When the data trusted exchange module configured by the first trusted data exchange gateway (31) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the data is encrypted, protected in integrity and digitally signed, and a trusted identification, delay identification and data size identification are added to form a special format and sent to the first unidirectional isolator (32); the first unidirectional isolator (32) performs private protocol encapsulation on the received data and sends it to the data trusted exchange module configured by the trusted isolation buffer proxy gateway (41); when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0075] D3. The isolation buffer subsystem (4) communicates with the receiving external access subsystem (5):

[0076] When the data trusted exchange module configured by the trusted isolation buffer proxy gateway (41) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the data is encrypted, protected in integrity and digitally signed, and a trusted identification, delay identification and data size identification are added to form a special format and sent to the transmission link allocation module configured by itself; the transmission link The path allocation module selects data to be sent to the second unidirectional isolator (42) or the third unidirectional isolator (43) according to the delay identifier and data size identifier of the received data; data with a small amount of transmission data and a high delay requirement are sent to the second unidirectional isolator (42); data with a large amount of transmission data and a low delay requirement are sent to the third unidirectional isolator (43); the second unidirectional isolator (42) or the third unidirectional isolator (43) performs private protocol encapsulation on the received data and sends it to the data trusted exchange module configured by the second trusted data exchange gateway (44); when the trusted measurement result is not trusted, the received data is discarded and the process returns to step B;

[0077] When the data trusted exchange module configured in the second trusted data exchange gateway (44) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the data is encrypted, protected in integrity and digitally signed, and a trusted identification, delay identification and data size identification are added to form a special format and sent to the data trusted exchange module configured in the receiving trusted computer (51); when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B;

[0078] D5. The receiving party's external access subsystem (5) receives the access data

[0079] When the data trusted exchange module configured by the receiving trusted computer (51) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the return is returned to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; when the trusted measurement result is trusted, the received data is integrity checked and digital signature verified, and after the verification passes, the received data is decrypted and restored to plain text data, and the connection data communication is completed; when the trusted measurement result is untrustworthy, the received data is discarded and the return is returned to step B.

Claims

1. A reliable heterogeneous redundant dual-channel data security access system, characterized by: include: The sender external access subsystem (1), the isolation exchange subsystem (3), the isolation buffer subsystem (4), and the receiver external access subsystem (5); wherein: The sender external access subsystem (1) comprises a sender trusted computer (11); The isolation exchange subsystem (3) comprises a first trusted data exchange gateway (31) and a first unidirectional isolator (32); The isolation buffer subsystem (4) comprises a trusted isolation buffer gateway (41), a second unidirectional isolator (42), a third unidirectional isolator (43), and a second trusted data exchange gateway (44); A receiver external access subsystem (5), including a receiver trusted computer (51); Along the data transmission direction, the data transmission link is sequentially from the sender trusted computer (11) to the first trusted data exchange gateway (31), to the first unidirectional isolator (32), to the trusted isolation buffer gateway (41), to the second unidirectional isolator (42) or the third unidirectional isolator (43), to the second trusted data exchange gateway (44), to the receiver trusted computer (51); The first unidirectional isolator (32), the second unidirectional isolator (42), and the third unidirectional isolator (43) are heterogeneous unidirectional isolators, comprising a transmitting end, a unidirectional channel, and a receiving end, wherein the transmitting end is used to receive data and perform private protocol encapsulation on the received data, the unidirectional channel is used to transmit the private protocol encapsulated data to the receiving end in a single direction, and the receiving end is used to receive data and send the data; The sender trusted computer (11), the receiver trusted computer (51), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) all have built-in trusted roots; Between the sender's trusted computer (11) and the first trusted data exchange gateway (31), between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41), between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44), and between the second trusted data exchange gateway (44) and the receiver's trusted computer (51), trusted interconnection authentication of the communicating parties is performed based on a trusted root, so as to realize the security and reliability of the data security connection system.

2. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 1, characterized in that: The sender's trusted computer (11), the receiver's trusted computer (51), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) are configured with a trusted security management module, the trusted security management module is used to implement trusted interconnection authentication and trusted measurement of the communicating parties, the trusted interconnection authentication is used for identity authentication of the communicating parties, and the trusted measurement measures the trusted state of itself.

3. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 2, characterized in that: The sender trusted computer (11), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) are also configured with a data trusted exchange module, which is used to process the received data according to the trusted measurement results of the trusted security management modules configured respectively; When the trust measurement result is trustworthy, the data is encrypted, protected in integrity and protected in digital signature, and a trust mark, delay mark and data size mark are added to form a special format and sent to the next level; when the result is untrustworthy, the received data is discarded; the receiving party's trusted computer (51) is configured with a data trust exchange module, and when the trust measurement result of the trusted security management module configured by itself is trustworthy, the received data is integrity checked and digitally signed, and after the verification is passed, the received data is decrypted and restored to plain text data; when the result is untrustworthy, the received data is discarded.

4. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 1 or 3, characterized in that: The first unidirectional isolator (32), the second unidirectional isolator (42), and the third unidirectional isolator (43) are of different types: optical shutter type isolation, photoelectric type isolation, and mechanical type isolation.

5. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 4, characterized in that: The data trusted exchange module performs a format check and a trusted identification check on the received data before processing the received data according to the trusted measurement results of the trusted security management module of the subsystem in which it is located; if the format check and the trusted identification check fail, the received data is discarded; if the format check and the trusted identification check pass, the received data is processed according to the trusted measurement results of the trusted security management module of the subsystem in which it is located.

6. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 5, characterized in that: It also includes an operation and maintenance management subsystem (6) for unified out-of-band management of the operating status and data transmission status of the sender's external access subsystem (1), the boundary protection subsystem (2), the isolation exchange subsystem (3), the isolation buffer subsystem (4), and the receiver's external access subsystem (5), and provides task-level full-process log auditing. The auditing elements include: task occurrence time, sender, receiver, path nodes, data size, and time.

7. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 6, characterized in that: The first unidirectional isolator (32) is an optical gate type unidirectional isolator; the second unidirectional isolator (42) is a photoelectric type unidirectional isolator, and the third unidirectional isolator (43) is a mechanical type unidirectional isolator; the trusted isolation buffer gateway (41) is equipped with a transmission link allocation module, which selects the data link of the second unidirectional isolator (42) or the third unidirectional isolator (43) according to the delay mark and data size mark of the received data, and sends the data with a small transmission data volume and a high delay requirement to the second unidirectional isolator (42); and sends the data with a large transmission data volume and a low delay requirement to the third unidirectional isolator (43).

8. A trusted heterogeneous redundant dual-channel data security access system as claimed in claim 6, characterized in that: It also includes a boundary protection subsystem (2), which is arranged between the sender's external access subsystem (1) and the isolation exchange subsystem (3) and is used to perform network isolation, access control, attack behavior monitoring, and malicious code detection security protection on the boundary between the sender's external access subsystem (1) and the isolation exchange subsystem (3); The trusted security management module also includes a trusted reporting function, which alarms when untrustworthy situations are found.

9. A reliable heterogeneous redundant dual-channel data security connection method, characterized by: A trusted heterogeneous redundant dual-channel data security connection system as claimed in claim 8 is used to perform full-link trusted interconnection authentication and secure and reliable transmission of connection data, and specifically perform the following steps: A. System Initialization Based on the operation and maintenance management subsystem, the sender external access subsystem (1), the isolation exchange subsystem (3), the isolation buffer subsystem (4), and the receiver external access subsystem (5) are initialized and configured in an out-of-band manner, the operating status and data exchange behavior of each subsystem are monitored in real time, and a task-level full-process log audit is performed; the sender trusted computer (11), the receiver trusted computer (51), the first trusted data exchange gateway (31), the trusted isolation buffer gateway (41), and the second trusted data exchange gateway (44) perform trusted state initialization and generate respective initial measurement values; the sender trusted computer (11) sends its own authentication object information as original authentication object information to the first trusted data exchange gateway (31), and the first trusted data exchange gateway (31) stores the received original authentication object information of the sender trusted computer (11) in the trusted root; the first trusted The data exchange gateway (31) sends its own authentication object information as original authentication object information to the trusted isolation buffer gateway (41), and the trusted isolation buffer gateway (41) stores the received original authentication object information of the first trusted data exchange gateway (31) in the trusted root; the trusted isolation buffer gateway (41) sends its own authentication object information as original authentication object information to the second trusted data exchange gateway (44), and the second trusted data exchange gateway (44) stores the received original authentication object information of the trusted isolation buffer gateway (41) in the trusted root; the second trusted data exchange gateway (44) sends its own authentication object information as original authentication object information to the receiving trusted computer (51), and the receiving trusted computer (51) stores the received original authentication object information of the second trusted data exchange gateway (44) in the trusted root; B. Full-link trusted interconnection authentication The data trusted exchange module of the sender's trusted computer (11) detects whether there is data to be linked; when there is data to be linked, the trusted interconnection authentication is started based on the trusted root between the sender's trusted computer (11) and the first trusted data exchange gateway (31), between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41), between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44), and between the second trusted data exchange gateway (44) and the receiver's trusted computer (51), and the process is as follows: B1. Trusted interconnection authentication between the sender's trusted computer (11) and the first trusted data exchange gateway (31): the trusted security management module of the sender's trusted computer (11) sends authentication object information to the trusted security management module of the first trusted data exchange gateway (31), and the trusted security management module of the first trusted data exchange gateway (31) compares the received authentication object information of the sender's trusted computer (11) with the original authentication object information of the sender's trusted computer (11) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the sender's trusted computer (11) establishes a communication connection with the first trusted data exchange gateway (31), and executes B2 to start the trusted interconnection authentication between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41); B2. Trusted interconnection authentication between the first trusted data exchange gateway (31) and the trusted isolation buffer gateway (41): the trusted security management module of the first trusted data exchange gateway (31) sends authentication object information to the trusted security management module of the trusted isolation buffer gateway (41), and the trusted security management module of the trusted isolation buffer gateway (41) receives the authentication object information of the first trusted data exchange gateway (31) and compares it with the original authentication object information of the first trusted data exchange gateway (31) stored in its trusted root; If the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B. If the comparison passes, the first trusted data exchange gateway (31) establishes a communication connection with the trusted isolation buffer gateway (41), and executes step B3 to start the trusted interconnection authentication between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44). B3. Trusted interconnection authentication between the trusted isolation buffer gateway (41) and the second trusted data exchange gateway (44): the trusted security management module of the trusted isolation buffer gateway (41) sends authentication object information to the trusted security management module of the second trusted data exchange gateway (44); The trusted security management module of the second trusted data exchange gateway (44) receives the authentication object information of the trusted isolation buffer gateway (41), and compares it with the original authentication object information of the trusted isolation buffer gateway (41) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the trusted isolation buffer gateway (41) establishes a communication connection with the second trusted data exchange gateway (44), and executes step B4 to start the trusted interconnection authentication between the second trusted data exchange gateway (44) and the receiving trusted computer (51); B4. Trusted interconnection authentication between the second trusted data exchange gateway (44) and the recipient's trusted computer (51): the trusted security management module of the second trusted data exchange gateway (44) sends authentication object information to the trusted security management module of the recipient's trusted computer (51); The trusted security management module of the receiving party's trusted computer (51) receives the authentication object information of the second trusted data exchange gateway (44), and compares it with the original authentication object information of the second trusted data exchange gateway (44) stored in its trusted root; if the comparison fails, the trusted interconnection authentication is stopped and the process returns to step B; if the comparison passes, the second trusted data exchange gateway (44) establishes a communication connection with the receiving party's trusted computer (51); C. The trusted security management module in the receiving party's trusted computer (51) notifies the data trusted exchange module in the sending party's trusted computer (11) that "the trusted channel is ready" through an out-of-band method (out-of-band management refers to the transmission of management information through an independent physical channel, which is separated from the data induction channel); the data trusted exchange module in the sending party's trusted computer (11) executes step D to induction data transmission; D. Connect data for data communication D1. The data trusted exchange module configured by the sender trusted computer (11) performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module configured by itself; When the trust measurement result is trustworthy, the data is encrypted, protected in terms of integrity, and protected by a digital signature, and a trust mark, a delay mark, and a data size mark are added to form a special format, which is then sent to the data trust exchange module configured in the first trustworthy data exchange gateway (31) after passing through the security protection of the boundary protection subsystem (2), and step D2 is executed; when the trust measurement result is untrustworthy, the received data is discarded, and the process returns to step B; D2. When the data trusted exchange module configured in the first trusted data exchange gateway (31) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; When the trust measurement result is trustworthy, the data is encrypted, protected in terms of integrity and digital signature, and a trust mark, delay mark and data size mark are added to form a special format and sent to the first one-way isolator (32); the first one-way isolator (32) performs private protocol encapsulation on the received data and sends it to the data trust exchange module configured by the trusted isolation buffer proxy gateway (41); when the trust measurement result is untrustworthy, the received data is discarded and the process returns to step B; D3. When the data trusted exchange module configured in the trusted isolation buffer proxy gateway (41) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; When the trusted measurement result is trusted, the data is encrypted, protected in terms of integrity and digital signature, and a trusted identifier, a delay identifier and a data size identifier are added to form a special format and sent to the transmission link allocation module configured by itself; the transmission link allocation module selects data to be sent to the second unidirectional isolator (42) or the third unidirectional isolator (43) according to the delay identifier and the data size identifier of the received data; data with a small amount of transmission data and a high delay requirement are sent to the second unidirectional isolator (42); data with a large amount of transmission data and a low delay requirement are sent to the third unidirectional isolator (43); the second unidirectional isolator (42) or the third unidirectional isolator (43) performs a private protocol encapsulation on the received data and sends it to the data trusted exchange module configured by the second trusted data exchange gateway (44); when the trusted measurement result is untrustworthy, the received data is discarded and the process returns to step B; D4. When the data trusted exchange module configured in the second trusted data exchange gateway (44) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the process returns to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; When the trust measurement result is trustworthy, the data is encrypted, protected in integrity and protected by a digital signature, a trust mark, a delay mark and a data size mark are added, and a special format is formed and sent to the data trust exchange module configured by the receiver's trustworthy computer (51); when the trust measurement result is untrustworthy, the received data is discarded and the process returns to step B; D5. When the data trusted exchange module configured in the receiving party's trusted computer (51) finds that there is data connection, it performs format check and trusted identification check on the received data; if the format check and trusted identification check fail, the received data is discarded and the return is returned to step B; if the format check and trusted identification check pass, the received data is processed according to the trusted measurement result of the trusted security management module of the subsystem; When the trusted measurement result is trusted, the received data is checked for integrity and digital signature verification. After the verification is passed, the received data is decrypted and restored to plain text data, and the data communication is completed. When the trusted measurement result is untrustworthy, the received data is discarded and returns to step B.

Images