One-way data transmission method, device and storage medium

Abstract

The present invention relates to a one-way data transmission method, device and storage medium, wherein the method includes using the same account to log in to an external network server and an internal network server; the external network server continuously monitors the clipboard content and file changes of the external network host computer, and if the external network server captures the changes, reads the change data, and sends the change data to a one-way isolation network gate; the external network processing module receives the change data and caches it to the external network data security island; the isolation module caches the change data to the internal network data security island; the internal network processing module receives and reconstructs the change data and forwards it to the internal network client; the internal network client periodically obtains the change data from the one-way isolation network gate. The present invention adopts a physical computing blade and completely separates the management network from the business data transmission network through a physically isolated dual network design.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a one-way data transmission method, device and storage medium. Background Art

[0002] With the development of cloud desktop technology, more and more enterprises and organizations have begun to adopt cloud desktop systems to centrally manage virtual machines and terminal devices. However, in traditional cloud desktop systems, users access and control virtual machines through a unified network. This centralized architecture poses security risks, especially when transmitting and processing sensitive files. Since the terminal access network and the business data network usually share the same network, when users control the virtual machine through the management interface, they can directly access and copy sensitive data in the cloud desktop computer, causing the risk of data leakage.

[0003] For technology and R&D companies, offices are often divided into external networks (Internet) and internal networks (office networks). Especially for companies with confidentiality or security requirements, isolation is achieved between the external network and the internal network. Importing data from the external network to the internal network requires manual or other artificial means, which greatly reduces the work efficiency of R&D personnel. It is very inconvenient for R&D personnel to check and copy data in real time, especially when code development needs to refer to code from the Internet. There are no ready-made products and technologies on the market to meet the needs of this scenario. Summary of the invention

[0004] The present invention provides a unidirectional data transmission method, device and storage medium, aiming to solve at least one of the technical problems existing in the prior art.

[0005] The technical solution of the present invention is a one-way data transmission method, which is applied to a one-way data transmission device. The one-way data transmission device includes an external network client, a one-way isolation network gate and an internal network client connected in sequence. The external network server is arranged on an external network host computer connected to the external network, and the internal network server is arranged on an internal network host computer connected to the internal network; the one-way isolation network gate includes: an external network processing module, the external network processing module includes an external network access unit and an external network isolation unit connected in sequence, and the external network isolation unit is provided with an external network data security island; an isolation module, which is used for IPSec processing and algorithm encryption and decryption; an internal network processing module, the internal network processing module includes an internal network isolation unit and an internal network access unit connected in sequence; a main control module, which is used to perform key negotiation and operation and maintenance management; a security protection module, which is used to collect and transmit destruction signals. The one-way data transmission method includes:

[0006] S100, using the same account to log in to the external network server and the internal network server, and establish a communication link between the external network host computer, the one-way isolation network gateway and the internal network host computer;

[0007] S200, the external network server continuously monitors the clipboard content and file changes of the external network host computer. If the external network server captures the changes, it reads the changed data and sends the changed data to the one-way isolation network gate through the network protocol;

[0008] S300, the external network processing module of the one-way isolation network gate receives the changed data and caches the changed data to the external network data security island;

[0009] S400, the isolation module of the one-way isolation network gate caches the changed data cached in the external network data security island to the internal network data security island;

[0010] S500, the intranet processing module of the one-way isolation gateway receives and reconstructs the changed data, and forwards it to the intranet client;

[0011] S600, the intranet client periodically obtains the changed data from the one-way isolation network gate, and writes the changed data into the clipboard of the intranet host computer or saves it as a file of the intranet host computer.

[0012] Further, the step S300 includes:

[0013] S310, the external network access unit strips off the TCP / IP protocol to obtain payload data, where the payload data is the data content in the changed data;

[0014] S320, the external network access unit sends the payload data to the external network isolation unit;

[0015] S330, the external network isolation unit receives the payload data and stores it in the external network data security island at the same time.

[0016] Further, the step S400 includes:

[0017] S410, the external network isolation unit disconnects from the external network access unit;

[0018] S420, the external network isolation unit is connected to the internal network isolation unit;

[0019] S430, the external network isolation unit sends the payload data to the internal network isolation unit;

[0020] S440, the intranet isolation unit receives the payload data and stores it in the intranet data security island at the same time.

[0021] Further, the step S500 includes:

[0022] S510, the internal network isolation unit disconnects from the external network isolation unit;

[0023] S520, the intranet isolation unit is connected to the intranet access unit;

[0024] S530, the intranet isolation unit sends the payload data to the intranet access unit;

[0025] S540: The intranet access unit re-encapsulates the network protocol and forwards it to the intranet client.

[0026] Furthermore, before step S300, the external network processing module also includes: the external network processing module receives the clipboard data sent by the external network host computer, first checks the data format to confirm whether the data format is correct, and then performs a private protocol conversion on the data. If the data format verification fails, the data is discarded;

[0027] The step S400 also includes: the isolation module receives the data sent by the external network processing module, first checks the data format, and discards the data that fails the check;

[0028] The step S500 also includes: the intranet processing module receives the data sent by the isolation module, first checks the data format to confirm whether the data format is correct, if the data format check fails, the data is discarded, the data format check converts the data into a private protocol through the data conversion module, and finally writes the converted data into the intranet unit data queue of the intranet client software.

[0029] Furthermore, the present invention also provides a one-way data transmission device for executing the one-way data transmission method, wherein the one-way data transmission device comprises an external network client, a one-way isolation network switch and an internal network client connected in sequence, wherein:

[0030] The external network server is arranged on an external network host computer connected to the external network, and the internal network server is arranged on an internal network host computer connected to the internal network, wherein the security level of the internal network is higher than that of the external network;

[0031] The one-way isolation network gate comprises:

[0032] An external network processing module, the external network processing module includes an external network access unit and an external network isolation unit connected in sequence, and the external network isolation unit is provided with an external network data security island;

[0033] An isolation module, used for IPSec processing and algorithm encryption and decryption, wherein the isolation module is connected to the external network processing module via a low voltage differential signaling technology interface LVDS;

[0034] An intranet processing module, used for quintuple filtering and data forwarding, the intranet processing module comprises an intranet isolation unit and an intranet access unit connected in sequence, the intranet processing module is connected to the isolation module via a low voltage differential signaling technology interface LVDS, and only allows data to flow unidirectionally from the external network isolation unit to the intranet isolation unit;

[0035] A main control module, used for performing key negotiation and operation and maintenance management, the main control module and the isolation module are connected via a reduced gigabit media independent interface RGMII (RGMII) for a service data channel and a secure digital input and output interface SDIO (SDIO) for a management data channel;

[0036] The safety protection module is used for collecting and transmitting the destruction signal, and the safety protection module is connected with the main control module via a universal asynchronous receiving and transmitting interface UART.

[0037] Further, the external network processing module includes an external network CPU for MAC learning and operation and maintenance management agent, an external network FPGA for quintuple filtering and data forwarding, and a first Ethernet interface, the external network CPU and the external network FPGA are connected through a secure digital input and output interface (Secure Digital Input and Output, SDIO), and the first Ethernet interface is adaptive to 10M / 100M / 1000M network;

[0038] The isolation module includes an isolation FPGA;

[0039] The intranet processing module includes an intranet FPGA, a second Ethernet interface and a third Ethernet interface, wherein the second Ethernet interface and the third Ethernet interface are adaptive to 10M / 100M / 1000M networks;

[0040] The main control module includes a main control CPU and an authentication interface connected via an I2C bus, wherein the authentication interface is connected to the main control CPU;

[0041] The safety protection module includes a security MCU and a destruction input terminal connected to the security MCU.

[0042] Furthermore, the master control CPU is provided with a master control CPU software for implementing key negotiation and operation and maintenance management, and the master control CPU software includes:

[0043] A main control CPU communication module, wherein the main control CPU communication module is used for communicating with the external network CPU, the isolated FPGA and the internal network FPGA;

[0044] A configuration management module, wherein the configuration management module receives a configuration query command and executes an action of querying each configuration of the device;

[0045] A security policy management module, which is used to configure, query and modify security policy rules;

[0046] A key negotiation module, wherein the key negotiation module is used in the negotiation process of the IPSec protocol and generates an SPD table and a SAD table;

[0047] A password management module, which is used to import and manage resources such as algorithm parameters and keys;

[0048] Self-check module, the self-check module is used for random number self-check and algorithm self-check. The random number self-check completes the detection of the quality of the random numbers generated by the random number chip to determine whether they meet the random number specification requirements. During the algorithm self-check, preset data is used to verify whether the algorithm is in normal working state.

[0049] Furthermore, the external network CPU is provided with external network CPU software for MAC learning, management agent and policy management, and the external network CPU software includes:

[0050] A MAC learning module, wherein the MAC learning module is used to cooperate with an external network FPGA to complete MAC learning;

[0051] A management agent module, which is used to cooperate with the operation and maintenance management of the device to complete the management of the external network CPU;

[0052] The external network CPU communication module is used to provide internal communication with other units inside the device.

[0053] Furthermore, the present invention also provides a computer-readable storage medium on which program instructions are stored. When the program instructions are executed by a processor, the one-way data transmission method is implemented.

[0054] The beneficial effects of the present invention are:

[0055] The one-way data transmission method, device and storage medium described above completely separate the management network from the business data transmission network by using physical computing blades and a physically isolated dual network design. This technical solution ensures that users can only control the interface and operations of the cloud PC in the cloud desktop system and cannot directly access files or data in the cloud PC, thereby ensuring the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 The figure is an overall flow chart of the one-way data transmission method.

[0057] Figure 2 A flow chart of an external network processing module of a one-way isolation network gate in a one-way data transmission method receiving change data and caching the change data to an external network data security island.

[0058] Figure 3The present invention is a flow chart of an isolation module of a one-way isolation network gate in a one-way data transmission method caching the changed data cached in an external network data security island to an internal network data security island.

[0059] Figure 4 The invention is a flow chart of an intranet processing module of a one-way isolation network gate in a one-way data transmission method receiving and reconstructing change data and forwarding it to an intranet client.

[0060] Figure 5 The figure is a flowchart of one-way data import in the one-way data transmission method.

[0061] Figure 6 It is a schematic diagram of the structure of a unidirectional isolation firewall in a unidirectional data transmission device.

[0062] Figure 7 The figure is a schematic diagram of the logical architecture of a unidirectional isolation firewall in a unidirectional data transmission method.

[0063] Figure 8 It is a schematic diagram of the software architecture of the main control CPU software and the main control CPU software in the one-way data transmission device.

[0064] Fig. 9 It is a schematic diagram of the working principle of one-to-one data transmission in the unidirectional data transmission method.

[0065] Fig.10 This is a schematic diagram of the working principle of the external network client in the one-way data transmission method.

[0066] Fig.11 This is a schematic diagram of the working principle of the intranet client in the one-way data transmission method.

[0067] Fig.12 It is a schematic diagram of cloud PC connection in a one-way data transmission device.

[0068] Fig.13 This is a schematic diagram of the terminal access network and business data network.

[0069] Fig.14 This is a schematic diagram of the structure for implementing dual network isolation within the cloud PC server.

[0070] Fig.15 A flowchart of controlling and operating computers in a business data network for users who have terminal access to the Internet under dual network isolation.

[0071] Fig.16 This is a schematic diagram of the interface between the encoding module of the user access network and the computing board of the service data network.

[0072] Fig.17 The schematic diagram of the software module structure of the external network client, the one-way isolation network gate and the internal network client in the one-way data transmission method. DETAILED DESCRIPTION

[0073] The following will be combined with the embodiments and drawings to clearly and completely describe the concept, specific structure and technical effects of the present invention, so as to fully understand the purpose, scheme and effect of the present invention. It should be noted that the embodiments and features in the embodiments of this application can be combined with each other without conflict.

[0074] It should be noted that, unless otherwise specified, when a feature is referred to as being "fixed" or "connected" to another feature, it may be directly fixed or connected to the other feature, or it may be indirectly fixed or connected to the other feature. In addition, the descriptions of up, down, left, right, top, bottom, etc. used in the present invention are only relative to the relative positional relationship of the components of the present invention in the drawings.

[0075] In addition, unless otherwise defined, all technical and scientific terms used herein have the same meaning as those generally understood by those skilled in the art. The terms used in this specification are only for describing specific embodiments, not for limiting the present invention. The term "and / or" used herein includes any combination of one or more related listed items.

[0076] It should be understood that, although the terms first, second, third, etc. may be used to describe various elements in the present disclosure, these elements should not be limited to these terms. These terms are only used to distinguish elements of the same type from each other. For example, without departing from the scope of the present disclosure, the first element may also be referred to as the second element, and similarly, the second element may also be referred to as the first element.

[0077] Reference Figures 1 to 17 In some embodiments, the technical solution of the present invention is a unidirectional data transmission method, which is applied to a unidirectional data transmission device, which includes an external network client, a unidirectional isolation network gate and an internal network client connected in sequence, wherein the external network server is arranged on an external network host computer connected to the external network, and the internal network server is arranged on an internal network host computer connected to the internal network; the unidirectional isolation network gate includes: an external network processing module, wherein the external network processing module includes an external network access unit and an external network isolation unit connected in sequence, wherein the external network isolation unit is provided with an external network data security island; an isolation module for IPSec processing and algorithm encryption and decryption; an internal network processing module, wherein the internal network processing module includes an internal network isolation unit and an internal network access unit connected in sequence; a main control module for performing key negotiation and operation and maintenance management; a security protection module for collecting and transmitting destruction signals, refer to Figures 1 to 5 , the one-way data transmission method comprises:

[0078] S100, using the same account to log in to the external network server and the internal network server, and establish a communication link between the external network host computer, the one-way isolation network gateway and the internal network host computer;

[0079] S200, the external network server continuously monitors the clipboard content and file changes of the external network host computer. If the external network server captures the changes, it reads the changed data and sends the changed data to the one-way isolation network gate through the network protocol;

[0080] S300, the external network processing module of the one-way isolation network gate receives the changed data and caches the changed data to the external network data security island;

[0081] S400, the isolation module of the one-way isolation network gate caches the changed data cached in the external network data security island to the internal network data security island;

[0082] S500, the intranet processing module of the one-way isolation gateway receives and reconstructs the changed data, and forwards it to the intranet client;

[0083] S600, the intranet client periodically obtains the changed data from the one-way isolation network gate, and writes the changed data into the clipboard of the intranet host computer or saves it as a file of the intranet host computer.

[0084] The beneficial effects of the present invention are:

[0085] The one-way data transmission method, device and storage medium described above completely separate the management network from the business data transmission network by using physical computing blades and a physically isolated dual network design. This technical solution ensures that users can only control the interface and operations of the cloud PC in the cloud desktop system and cannot directly access files or data in the cloud PC, thereby ensuring the security of data transmission.

[0086] The technical solution of the present invention can effectively solve the potential safety hazards in traditional cloud desktop systems. The specific effects are as follows:

[0087] (1) Preventing data leakage: Since the terminal access network and the business data network are physically isolated, users cannot directly access or copy the data and files in the virtual machine through the management network, completely eliminating the risk of data leakage through the network.

[0088] (2) Improve system security: The physical isolation design of the two networks enhances the security of the system, so that the security vulnerabilities of either network will not affect the other network, reducing potential security threats.

[0089] (3) Adaptability to scenarios with high security requirements: The present invention is suitable for scenarios with extremely high data security requirements, such as finance and enterprise sensitive information processing, ensuring the security of data during storage and transmission.

[0090] (4) Improve user experience: Although users can only access the network through a terminal to control the interface of the cloud PC, their operations are smooth, the interface responds quickly, and will not be affected by the security protection measures of the business data transmission network, ensuring the efficiency and security of the system.

[0091] The protection points of the present invention mainly include: the management network and the business data transmission network adopt a physical isolation technical solution to ensure the dual network structure of data security. Users can only operate the interface of the virtual machine in the management network and cannot access any files or data in the business data transmission network. Data files are only transmitted and stored through the physically isolated business network, eliminating the risk of obtaining data through the management network and ensuring data security.

[0092] In a specific application scenario, a server with a one-way isolation firewall is set up between the PC on the external network and the PC on the internal network. The internal and external network units of the server run service programs respectively. The internal and external network PCs install client programs respectively and log in to the corresponding servers. After running the client program, the copy action is executed on the external network PC, and the copied content will be transferred to the internal network PC. When the paste action is executed, the copied internal network can be seen, thereby realizing copy and paste between different PCs in different networks and improving the development efficiency of R&D personnel.

[0093] The advantages of the present invention are: easy to use. After setting up the network environment, installing the client and logging in, you can copy and paste content from the external network PC to the internal network at will, which is the same as copying and pasting on the same PC, greatly improving office efficiency; no manual intervention is required, reducing labor costs; it is universal and can be used in similar R&D enterprises with multiple network separations while facilitating the work of R&D personnel.

[0094] Further, refer to Figure 2 , the step S300 comprises:

[0095] S310, the external network access unit strips off the TCP / IP protocol to obtain payload data, where the payload data is the data content in the changed data;

[0096] S320, the external network access unit sends the payload data to the external network isolation unit;

[0097] S330, the external network isolation unit receives the payload data and stores it in the external network data security island at the same time.

[0098] Further, refer to Figure 3 , the step S400 comprises:

[0099] S410, the external network isolation unit disconnects from the external network access unit;

[0100] S420, the external network isolation unit is connected to the internal network isolation unit;

[0101] S430, the external network isolation unit sends the payload data to the internal network isolation unit;

[0102] S440, the intranet isolation unit receives the payload data and stores it in the intranet data security island at the same time.

[0103] Further, refer to Figure 4 , the step S500 comprises:

[0104] S510, the internal network isolation unit disconnects from the external network isolation unit;

[0105] S520, the intranet isolation unit is connected to the intranet access unit;

[0106] S530, the intranet isolation unit sends the payload data to the intranet access unit;

[0107] S540: The intranet access unit re-encapsulates the network protocol and forwards it to the intranet client.

[0108] Furthermore, before step S300, the external network processing module also includes: the external network processing module receives the clipboard data sent by the external network host computer, first checks the data format to confirm whether the data format is correct, and then performs a private protocol conversion on the data. If the data format verification fails, the data is discarded;

[0109] The step S400 also includes: the isolation module receives the data sent by the external network processing module, first checks the data format, and discards the data that fails the check;

[0110] The step S500 also includes: the intranet processing module receives the data sent by the isolation module, first checks the data format to confirm whether the data format is correct, if the data format check fails, the data is discarded, the data format check converts the data into a private protocol through the data conversion module, and finally writes the converted data into the intranet unit data queue of the intranet client software.

[0111] Further, refer to Figure 6 The present invention also proposes a one-way data transmission device for executing the one-way data transmission method. The one-way data transmission device comprises an external network client, a one-way isolation network switch and an internal network client connected in sequence, wherein:

[0112] The external network server is arranged on an external network host computer connected to the external network, and the internal network server is arranged on an internal network host computer connected to the internal network, wherein the security level of the internal network is higher than that of the external network;

[0113] The one-way isolation network gate comprises:

[0114] An external network processing module, the external network processing module includes an external network access unit and an external network isolation unit connected in sequence, and the external network isolation unit is provided with an external network data security island;

[0115] An isolation module, used for IPSec processing and algorithm encryption and decryption, wherein the isolation module is connected to the external network processing module via a low voltage differential signaling technology interface LVDS;

[0116] An intranet processing module, used for quintuple filtering and data forwarding, the intranet processing module comprises an intranet isolation unit and an intranet access unit connected in sequence, the intranet processing module is connected to the isolation module via a low voltage differential signaling technology interface LVDS, and only allows data to flow unidirectionally from the external network isolation unit to the intranet isolation unit;

[0117] A main control module, used for performing key negotiation and operation and maintenance management, the main control module and the isolation module are connected via a reduced gigabit media independent interface RGMII (RGMII) for a service data channel and a secure digital input and output interface SDIO (SDIO) for a management data channel;

[0118] The safety protection module is used for collecting and transmitting the destruction signal, and the safety protection module is connected with the main control module via a universal asynchronous receiving and transmitting interface UART.

[0119] Specifically, the one-way isolation gateway is designed to provide secure data transmission between networks with different security levels. It only allows data to flow from a low-security network (such as the Internet) to a high-security network (such as an intranet) in one direction, preventing any reverse data flow and ensuring data security in the high-security network. The one-way isolation gateway uses technologies such as FPGA, data security islands, and ferry control systems to achieve one-way transmission from the external network to the internal network, ensuring that data can only flow from a low-security network to a high-security network in one direction, effectively preventing reverse data transmission.

[0120] The one-way isolation gateway is mainly composed of an internal network processing module, an external network processing module, an isolation module, a main control module, and a security protection module. The internal network processing module / external network processing module and the isolation module are connected through the LVDS bus, the main control module and the isolation module are connected through the RGMII and SDIO buses, and the main control module and the security protection module are connected through the UART interface.

[0121] 1) Intranet processing module

[0122] The internal network processing module consists of 1 FPGA, which mainly completes the quintuple filtering and data forwarding functions. The internal network processing module is connected to the isolation module through the LVDS bus, and provides 2 Ethernet interfaces to the outside, supporting 10 / 100 / 1000M self-adaptation.

[0123] 2) External network processing module

[0124] The external network processing module consists of 1 CPU and 1 FPGA, which are connected via the SDIO interface. The CPU mainly completes the functions of MAC learning and operation and maintenance management agent, and the FPGA mainly completes the quintuple filtering and data forwarding functions. The external network processing module is connected to the isolation module via the LVDS bus, and provides an Ethernet interface to the outside, supporting 10 / 100 / 1000M self-adaptation.

[0125] 3) Isolation module

[0126] The isolation module mainly completes the IPSec processing and algorithm encryption and decryption functions. It is implemented using FPGA and is connected to the intranet FPGA and the extranet FPGA (black area FPGA) through the LVDS bus. It is connected to the main control module through the RGMII and SDIO buses. The RGMII bus serves as the business data channel and the SDIO serves as the management data channel.

[0127] 4) Main control module

[0128] The main control module mainly completes the key negotiation and operation and maintenance management functions of the equipment.

[0129] 5) Security module

[0130] The security module mainly completes the collection and transmission functions of the destruction signal and is connected to the main control module through the UART interface.

[0131] Reference Fig. 9 , introduces the working principle of the one-way isolation firewall. The one-way isolation firewall ensures one-to-one transmission of data from the external network to the internal network through strict user authentication and data binding mechanisms, eliminating the possibility of data transmission errors. The core of the system design is to ensure the high security and accuracy of data transmission and ensure that data can only be received by the designated recipient (the same user). The system supports manual creation of users and docking with existing AD domains for user management. Users need to log in with the same account on both the external network client and the internal network client. The data entered by the external network user can only be entered into the computer where the client logged in with the same user on the internal network is located.

[0132] Reference Fig.10,The working principle of the external network client,The external network client software monitors the clipboard content and file changes of the external network computer through a scheduled task or real-time monitoring mechanism. Once a change in the clipboard content or a new / modified file is detected, the software will immediately read the corresponding data and send it to the one-way isolation network gate through the network protocol.

[0133] 1) Clipboard monitoring and reading: After the external network client software is started, it will continue to monitor the changes in the clipboard content. When the user copies new content on the clipboard, the monitoring module will capture the change and call the content reading module to obtain the clipboard data. The read data will be pre-processed, including formatting, to ensure the security of the data during transmission.

[0134] 2) File change monitoring and upload: The software will monitor file changes in the specified directory and capture file addition or modification events. The changed files will be read and uploaded to the one-way isolation network gate. The file upload module supports batch transfer of large files and multiple files, and can resume breakpoint transfer to ensure the stability of file transfer.

[0135] Reference Fig.11 ,The working principle of the intranet client, the intranet client software regularly obtains data from the one-way isolation network gate, and writes the data to the clipboard of the intranet computer or saves it as a file. Through the scheduled task, the intranet client software can ensure the timely synchronization of the clipboard and file data.

[0136] 1) Clipboard data synchronization: The intranet client software periodically calls the synchronization interface to obtain clipboard data from the one-way isolation network gate. The obtained data will be decoded and format converted, and written to the clipboard of the intranet computer. Users can directly access and use the synchronized clipboard content on the intranet computer.

[0137] 2) File data synchronization: The intranet client software periodically calls the download interface to obtain file data from the one-way isolation network gate. The downloaded files will be saved to the specified directory, and users can directly access and use the synchronized files on the intranet computer. The file download module supports batch download of large files and multiple files to ensure the efficiency and stability of file transmission.

[0138] Further, refer to Figure 8 The external network processing module includes an external network CPU for MAC learning and operation and maintenance management agent, an external network FPGA (black area FPGA) for quintuple filtering and data forwarding, and a first Ethernet interface. The external network CPU and the external network FPGA (black area FPGA) are connected through a secure digital input and output interface (Secure Digital Input and Output, SDIO), and the first Ethernet interface is adaptive to 10M / 100M / 1000M network;

[0139] The isolation module includes an isolation FPGA;

[0140] The intranet processing module includes an intranet FPGA, a second Ethernet interface and a third Ethernet interface, wherein the second Ethernet interface and the third Ethernet interface are adaptive to 10M / 100M / 1000M networks;

[0141] The main control module includes a main control CPU and an authentication interface connected via an I2C bus, wherein the authentication interface is connected to the main control CPU;

[0142] The safety protection module includes a security MCU and a destruction input terminal connected to the security MCU.

[0143] Specifically, refer to Figure 7 The internal network FPGA mainly completes the functions of five-tuple filtering, message parsing, and message fragmentation; the isolation FPGA mainly completes the IPSec protocol processing and data encryption and decryption; the external network FPGA (black area FPGA) mainly completes the functions of five-tuple filtering and message analysis. The internal network FPGA and the isolation FPGA, and the isolation FPGA and the external network FPGA (black area FPGA) are interconnected using proprietary protocols.

[0144] 1) Intranet FPGA

[0145] a) Intranet Gigabit Ethernet port module: provides an Ethernet interface for the intranet cloud PC management platform;

[0146] b) Message parsing module: extracts message header information and performs parsing and stripping;

[0147] c) Message editing module: uses the characteristic information separated by the message analysis module and the logical channel number obtained by searching the security association database to reassemble the message to form a standard Ethernet message;

[0148] d) Message scheduling module: completes the scheduling of messages;

[0149] e) Message filtering module: mainly performs five-tuple filtering on messages entering the device.

[0150] 2) Isolate FPGA

[0151] a) Isolation authentication module: responsible for providing the logic unit for calling the algorithm in the external algorithm engine, and filtering the message according to the authentication result. The authenticated message is sent to the IPSec processing module;

[0152] b) IPSec processing module: mainly responsible for IPSec protocol processing of messages and filtering of input and output messages according to the security association database;

[0153] c) SP table lookup module: implements table lookup of the internal security policy database;

[0154] d) SA table lookup module: implements table lookup of the internal security association database;

[0155] e) FIFO interface module: mainly realizes the communication between the trusted module and the isolated FPGA;

[0156] f) IP layer data processing module: encrypts and decrypts IP layer data using SM2 / SM3 / SM4 algorithms.

[0157] 3) External FPGA (Black Area FPGA)

[0158] a) External Gigabit Ethernet port module: provides Ethernet interface for external network;

[0159] b) Message parsing module: extracts message header information and performs parsing and stripping;

[0160] c) Message editing module: uses the characteristic information separated by the message analysis module and the logical channel number obtained by searching the security association database to reassemble the message to form a standard Ethernet message.

[0161] Further, refer to Figure 8 The master CPU is provided with a master CPU software for implementing key negotiation and operation and maintenance management, and the master CPU software includes:

[0162] A main control CPU communication module, wherein the main control CPU communication module is used for communicating with the external network CPU, the isolated FPGA and the internal network FPGA;

[0163] A configuration management module, wherein the configuration management module receives a configuration query command and executes an action of querying each configuration of the device;

[0164] A security policy management module, which is used to configure, query and modify security policy rules;

[0165] A key negotiation module, wherein the key negotiation module is used in the negotiation process of the IPSec protocol and generates an SPD table and a SAD table;

[0166] A password management module, which is used to import and manage resources such as algorithm parameters and keys;

[0167] Self-check module, the self-check module is used for random number self-check and algorithm self-check. The random number self-check completes the detection of the quality of the random numbers generated by the random number chip to determine whether they meet the random number specification requirements. During the algorithm self-check, preset data is used to verify whether the algorithm is in normal working state.

[0168] Further, refer to Figure 8 The external network CPU (black area CPU) is provided with external network CPU software for MAC learning, management agent and policy management, and the external network CPU software includes:

[0169] A MAC learning module, wherein the MAC learning module is used to cooperate with an external network FPGA (black area FPGA) to complete MAC learning;

[0170] A management agent module, which is used to cooperate with the operation and maintenance management of the device to complete the management of the external network CPU;

[0171] The external network CPU communication module is used to provide internal communication with other units inside the device.

[0172] Reference Fig.17 In a specific embodiment, the functions of the external network client and the internal network client are similar, and they respectively include an interface module, a login module, a clipboard monitoring and management module, a data processing module, and a communication module; the one-way isolation network gateway device includes an external network service program and an internal network service program with similar functions, and the external network service program and the internal network service program respectively include a user management module, a data processing module, a channel management module, and a communication module.

[0173] Among them, the interface module mainly provides functions such as interface display, client configuration options, and user login portal. After login, the client is automatically minimized to the system tray and the interface is no longer displayed. When needed, double-click in the system tray to display it again.

[0174] The login module mainly provides user login function, interacts with the server to log in, and verifies whether the user is a legitimate user.

[0175] The clipboard monitoring and management module monitors the status changes of the system clipboard. When the user presses the key to perform a copy action or right-clicks to perform a copy action, the corresponding content information will be inserted into the system clipboard. After the clipboard monitoring and management module detects the changes in the system clipboard, it obtains the relevant information and change information in the clipboard; when the intranet client receives data sent by the external network client, it parses the data and inserts it into the clipboard, updates the system clipboard status, and when the user performs a key paste action or right-clicks to paste, it copies the data from the clipboard to the target.

[0176] The data processing module on the client side of the external network is mainly responsible for formatting the data taken from the clipboard, packaging it into data packets and sending it to the communication module; on the client side of the internal network, the communication module is mainly responsible for processing the data after receiving it, restoring it to the data format that meets the clipboard requirements, and sending it to the clipboard monitoring and management module.

[0177] The client communication module is mainly used to communicate with the server, ensure link availability, maintain link status, and provide reliable transmission services.

[0178] The server-side user management module is used to maintain registered user information, verify user login information when the user logs in through the client, and synchronize user information from the enterprise AD domain server through the AD domain.

[0179] The server-side data processing module performs format processing, encapsulation and decapsulation on the data sent by the client.

[0180] The server communication module is used for communication between users and clients to realize data transmission, and at the same time controls data to be transmitted in one direction only; the server communication module is also used to maintain connections with multiple clients, realize concurrency of multiple user connections, and maintain link status; the server communication module is also used to realize the ferry function between the intranet server communication module and the extranet server communication module.

[0181] The working principle is:

[0182] 1) Log in to the client on the external network PC and log in to the client on the internal network PC;

[0183] 2) If there is data on the external PC that you want to copy and paste to the internal PC, select the object (file or text) to be copied and pasted on the external PC, and then press key or right-click to copy, and the object information will be inserted into the system clipboard;

[0184] 3) After the clipboard monitoring management module detects the change of the system clipboard status, it takes out the information in the clipboard;

[0185] 4) The data processing module receives the information, packages it, and sends it to the communication module;

[0186] 5) The communication module uses the pre-established link to send data to the server program;

[0187] 6) After receiving the data, the server program performs ferry processing, identifies the corresponding client and channel link, and then sends the data on the corresponding link;

[0188] 7) After receiving the data, the PC client on the intranet side performs data restoration processing and inserts it into the system clipboard after processing is completed;

[0189] 8) The clipboard monitoring and management module on the intranet side will update the corresponding status information;

[0190] 9) When you perform a paste operation on the PC on the intranet side, the information in the clipboard will be copied to the corresponding target.

[0191] In summary, the present invention can copy and paste content from an external network PC to an internal network at will, which is the same as copying and pasting on the same PC. It is convenient and timely to use, and the user is unaware of it. It is the same as local copy and paste, which greatly improves office efficiency. It can only copy and paste from the external network to the internal network, but not from the internal network to the external network, thus realizing one-way copy and paste. It has universality and can be used in similar R&D enterprises with multiple network separations while facilitating the office work of R&D personnel. There is no need for manual intervention in data import, which reduces labor costs.

[0192] In a specific embodiment, referring to Fig.12 The one-way data transmission device is set on the cloud PC system. Different from the virtual machine used in the traditional cloud desktop, the cloud PC server of the present invention adopts a physical computing blade.

[0193] On the premise of physical computing blades, the present invention adopts a physically isolated dual network architecture, that is, two independent networks are used to process management operations and business data transmission respectively. Specifically:

[0194] (1) Terminal access network (external network): This network is only used for user interface interaction with cloud PCs, including displaying the computer screen, transmitting mouse and keyboard control, and other basic operations. Users can only control cloud PCs through the terminal access network, but cannot directly access files and data inside cloud PCs.

[0195] (2) Business data network (intranet): This network is used exclusively for the storage, transmission and processing of data in cloud PC computers. All sensitive files, data and information are transmitted through this network, and users cannot access or operate them in any form through terminal access network.

[0196] Reference Fig.13 The red network is the service data network, and the blue network is the terminal access network. The two networks are isolated, and the user end on the right side of the figure cannot access the network of the data center on the left side. The user end can control the computer of the cloud PC server through the mouse and keyboard, and view the desktop image of the computer of the cloud PC server through the display screen, but cannot access the data service network connected to the data center.

[0197] Reference Fig.14, the yellow line is the data service network, and the red line is the terminal access network. The network switching module consists of two independent switching boards, namely the business data center network switching board and the terminal access network switching board. The business data network is used for network data transmission between PCs; the terminal access network is used to transmit media streams of screen images and audio data, as well as control signals such as mouse and keyboard. The system uses two completely independent network switching boards to connect to the business data and terminal access networks respectively. The terminal access network is connected to the user terminal through a secure port for transmitting user input and the display interface of the cloud PC computer; while the business data network is connected to the storage and data transmission server through an independent physical link, which is specifically used for data storage and transmission.

[0198] Reference Fig.15 ,Under dual network isolation, the process of users accessing the network through terminals to control and operate computers in the business data network:

[0199] (1) After the cloud PC computing blade (encoding card) is started, it reports its status to the cloud PC management platform;

[0200] (2) The cloud PC user terminal / soft terminal connects and sends a login request to the cloud PC management platform;

[0201] (3) The cloud PC user terminal / soft terminal selects and connects to the encoding card, and the cloud PC management platform forwards the connection request;

[0202] (4) The cloud PC computing blade (encoding card) establishes a media channel with the cloud PC user terminal / soft terminal;

[0203] (5) The cloud PC computing blade encoding card establishes a USB channel with the cloud PC user terminal.

[0204] Reference Fig.16 The description of the dual-network physical interfaces of the cloud PC computing blade is as follows:

[0205] Interface Name Interface Protocol Interface Description A HDMI Video signal output interface, two channels in total, corresponding to the main and auxiliary screens respectively. B USB3.0 The USB interface is currently mainly used as a device end, mainly for virtual USB keyboard and mouse, and transmission channels C Audio Interface Analog interface

[0206] Among them, the audio port is an analog interface and does not have data communication function; the HDMI port is a one-way port and is only used for the computing board to output images; the USB port is simulated by the encoding board as a mouse and keyboard interface, and is also a transmission interface.

[0207] Furthermore, the present invention also provides a computer-readable storage medium on which program instructions are stored. When the program instructions are executed by a processor, the one-way data transmission method is implemented.

[0208] The above is only a preferred embodiment of the present invention. The present invention is not limited to the above implementation. As long as the technical effect of the present invention is achieved by the same means, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of protection of the present disclosure. All should belong to the protection scope of the present invention. Within the protection scope of the present invention, its technical scheme and / or implementation method can have various modifications and changes.

Claims

1. A one-way data transmission method, the one-way data transmission method is applied to a one-way data transmission device, the one-way data transmission device comprises an external network client, a one-way isolation network gate and an internal network client connected in sequence, the external network server is arranged on an external network host computer connected to the external network, and the internal network server is arranged on an internal network host computer connected to the internal network; the one-way isolation network gate comprises: An external network processing module, the external network processing module includes an external network access unit and an external network isolation unit connected in sequence, and the external network isolation unit is provided with an external network data security island; An isolation module for IPSec processing and algorithm encryption and decryption; an intranet processing module, the intranet processing module comprising an intranet isolation unit and an intranet access unit connected in sequence; a main control module for performing key negotiation and operation and maintenance management; The security protection module is used to collect and transmit the destruction signal, wherein the one-way data transmission method includes: S100, using the same account to log in to the external network server and the internal network server, and establish a communication link between the external network host computer, the one-way isolation network gateway and the internal network host computer; S200, the external network server continuously monitors the clipboard content and file changes of the external network host computer. If the external network server captures the changes, it reads the changed data and sends the changed data to the one-way isolation network gate through the network protocol; S300, the external network processing module of the one-way isolation network gate receives the changed data and caches the changed data to the external network data security island; S400, the isolation module of the one-way isolation network gate caches the changed data cached in the external network data security island to the internal network data security island; S500, the intranet processing module of the one-way isolation gateway receives and reconstructs the changed data, and forwards it to the intranet client; S600, the intranet client periodically obtains the changed data from the one-way isolation network gate, and writes the changed data into the clipboard of the intranet host computer or saves it as a file of the intranet host computer.

2. The one-way data transmission method according to claim 1, characterized in that: The step S300 includes: S310, the external network access unit strips off the TCP / IP protocol to obtain payload data, where the payload data is the data content in the changed data; S320, the external network access unit sends the payload data to the external network isolation unit; S330, the external network isolation unit receives the payload data and stores it in the external network data security island at the same time.

3. The one-way data transmission method according to claim 1, characterized in that: The step S400 includes: S410, the external network isolation unit disconnects from the external network access unit; S420, the external network isolation unit is connected to the internal network isolation unit; S430, the external network isolation unit sends the payload data to the internal network isolation unit; S440, the intranet isolation unit receives the payload data and stores it in the intranet data security island at the same time.

4. The one-way data transmission method according to claim 1, characterized in that: The step S500 includes: S510, the internal network isolation unit disconnects from the external network isolation unit; S520, the intranet isolation unit is connected to the intranet access unit; S530, the intranet isolation unit sends the payload data to the intranet access unit; S540: The intranet access unit re-encapsulates the network protocol and forwards it to the intranet client.

5. The one-way data transmission method according to claim 1, characterized in that: The step S300 also includes: the external network processing module receives the clipboard data sent by the external network host computer, first checks the data format to confirm whether the data format is correct, and then converts the data into a private protocol. If the data format verification fails, the data is discarded; The step S400 also includes: the isolation module receives the data sent by the external network processing module, first checks the data format, and discards the data that fails the check; The step S500 also includes: the intranet processing module receives the data sent by the isolation module, first checks the data format to confirm whether the data format is correct, if the data format check fails, the data is discarded, the data format check converts the data into a private protocol through the data conversion module, and finally writes the converted data into the intranet unit data queue of the intranet client software.

6. A unidirectional data transmission device, used to execute the unidirectional data transmission method according to any one of claims 1 to 5, characterized in that: The one-way data transmission device comprises an external network client, a one-way isolation network switch and an internal network client connected in sequence, wherein: The external network server is arranged on an external network host computer connected to the external network, and the internal network server is arranged on an internal network host computer connected to the internal network, wherein the security level of the internal network is higher than that of the external network; The one-way isolation network gate comprises: An external network processing module, the external network processing module includes an external network access unit and an external network isolation unit connected in sequence, and the external network isolation unit is provided with an external network data security island; An isolation module, used for IPSec processing and algorithm encryption and decryption, wherein the isolation module is connected to the external network processing module via a low voltage differential signaling technology interface LVDS; An intranet processing module, used for quintuple filtering and data forwarding, the intranet processing module comprises an intranet isolation unit and an intranet access unit connected in sequence, the intranet processing module is connected to the isolation module via a low voltage differential signaling technology interface LVDS, and only allows data to flow unidirectionally from the external network isolation unit to the intranet isolation unit; A main control module, used for performing key negotiation and operation and maintenance management, the main control module is connected to the isolation module via a gigabit medium independent interface RGMII for a service data channel and a secure digital input and output interface SDIO for a management data channel; The safety protection module is used for collecting and transmitting the destruction signal, and the safety protection module is connected with the main control module via a universal asynchronous receiving and transmitting interface UART.

7. The one-way data transmission device according to claim 6, characterized in that: The external network processing module includes an external network CPU for MAC learning and operation and maintenance management agent, an external network FPGA and a first Ethernet interface for quintuple filtering and data forwarding, the external network CPU and the external network FPGA are connected through a secure digital input and output interface SDIO, and the first Ethernet interface is adaptive to 10M / 100M / 1000M network; The isolation module includes an isolation FPGA; The intranet processing module includes an intranet FPGA, a second Ethernet interface and a third Ethernet interface, wherein the second Ethernet interface and the third Ethernet interface are adaptive to 10M / 100M / 1000M networks; The main control module includes a main control CPU and an authentication interface connected via an I2C bus, wherein the authentication interface is connected to the main control CPU; The safety protection module includes a security MCU and a destruction input terminal connected to the security MCU.

8. The one-way data transmission device according to claim 7, characterized in that: The master control CPU is provided with a master control CPU software for implementing key negotiation and operation and maintenance management, and the master control CPU software includes: A main control CPU communication module, wherein the main control CPU communication module is used for communicating with the external network CPU, the isolated FPGA and the internal network FPGA; A configuration management module, wherein the configuration management module receives a configuration query command and executes an action of querying each configuration of the device; A security policy management module, which is used to configure, query and modify security policy rules; A key negotiation module, wherein the key negotiation module is used in the negotiation process of the IPSec protocol and generates an SPD table and a SAD table; A password management module, which is used to import and manage resources such as algorithm parameters and keys; Self-check module, the self-check module is used for random number self-check and algorithm self-check. The random number self-check completes the detection of the quality of the random numbers generated by the random number chip to determine whether they meet the random number specification requirements. During the algorithm self-check, preset data is used to verify whether the algorithm is in normal working state.

9. The one-way data transmission device according to claim 7, characterized in that: The external network CPU is provided with external network CPU software for MAC learning, management agent and policy management, and the external network CPU software includes: A MAC learning module, wherein the MAC learning module is used to cooperate with an external network FPGA to complete MAC learning; A management agent module, which is used to cooperate with the operation and maintenance management of the device to complete the management of the external network CPU; The external network CPU communication module is used to provide internal communication with other units inside the device.

10. A computer-readable storage medium having program instructions stored thereon, characterized in that: When the program instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images