Gateway with internal and external network fusing and gateway fusing control method

Abstract

The invention discloses a gateway with internal and external network fusing and a gateway fusing control method. The gateway comprises two mutually independent computing systems, namely an internal network system and an external network system. The intranet system and the extranet system are connected through a data line. And a fuse switch is configured on the data line. And the fuse switch is connected with an intranet system. And the extranet system tracks the system abnormity, and sends the system abnormity to the intranet system when the safe system abnormity exists. And the intranet system tracks security system anomalies. And when the system is tracked to be abnormal, the fuse switch is instructed to cut off the data line between the internal network system and the external network system. Therefore, when the gateway is attacked, the network security of the intranet is ensured.

Description

Technical Field

[0001] The present invention relates to an intranet and an extranet gateway, and in particular to a security protection technology for the intranet and an extranet gateway. Background Art

[0002] The intranet and extranet gateway or router is a device used to realize the interconnection between the intranet and extranet, and its security is extremely important. The applicant's patent application document CN 107018154 A discloses a router and routing method based on the application layer for connecting the intranet and extranet. The router uses two independent computing modules isolated from each other for data interaction between the intranet and extranet in an application layer-based manner, thereby avoiding most attacks from the Internet, isolating attacks from the Internet outside the gateway, and ensuring the security of the enterprise intranet or private network. However, attacks from the Internet are always carried out in some unknown ways. Even this router that connects the intranet and extranet based on the application layer still has security risks. Summary of the invention

[0003] The problem to be solved by the present invention is: the security problem of the interconnection between internal and external networks.

[0004] To solve the above problems, the solution adopted by the present invention is as follows: According to the present invention, a gateway with internal and external network fuses includes an internal network system for connecting to an internal network and an external network system for connecting to an external network, wherein the internal network system and the external network system are connected via a data line; a fuse switch is provided on the data line between the internal network system and the external network system; the fuse switch is connected to the internal network system via a control line; the external network system is provided with a system abnormality monitoring module and a system abnormality sending module; the internal network system is provided with a system abnormality tracking module and a fuse switch control module; The system abnormality monitoring module is used to: monitor whether there is a system abnormality; The system abnormality sending module is used to: when the system abnormality monitoring module detects that there is a system abnormality, send system abnormality information to the intranet system through the data line; The system abnormality tracking module is used to: track external network system abnormalities by receiving system abnormality information; The fuse switch control module is used to instruct the fuse switch to cut off the data line between the internal network system and the external network system when an abnormality in the external network system is tracked.

[0005] Further, according to the gateway with internal and external network fuses of the present invention, the data line realizes data communication between the external network system and the internal network system through a dual-port random access memory, or realizes data communication between the external network system and the internal network system through Ethernet.

[0006] Further, according to the gateway with internal and external network fuses of the present invention, in the system abnormality sending module, when the system abnormality monitoring module does not detect the system abnormality, heartbeat information is periodically sent to the internal network system through the data line; the tracking of the external network system abnormality includes receiving the system abnormality information and not receiving the heartbeat information sent by the external network system.

[0007] Further, according to the gateway with internal and external network fuses of the present invention, the content monitored for monitoring whether there is a system abnormality includes: device resource usage, abnormal process startup, abnormal file writing, abnormal permission change, abnormal network connection, and virus identification.

[0008] Furthermore, according to the gateway with internal and external network fuses of the present invention, the internal network system is also configured with a system abnormality alarm module; the system abnormality alarm module is used to: when an abnormality of the external network system is tracked, issue a warning prompt to the staff.

[0009] According to a gateway fuse control method of the present invention, the gateway includes an intranet system for connecting to an intranet and an extranet system for connecting to an extranet, the intranet system and the extranet system are connected via a data line; a fuse switch is provided on the data line between the intranet system and the extranet system; the fuse switch is connected to the intranet system via a control line; the method includes the following steps: Step SO1: the external network system monitors whether there is any system abnormality; Step SO2: When a system abnormality is detected, the external network system sends system abnormality information to the internal network system through the data line; Step SI1: The intranet system tracks the anomaly of the external network system by receiving system anomaly information; Step SI2: When an abnormality in the external network system is detected, the internal network system instructs the fuse switch to cut off the data line between the internal network system and the external network system.

[0010] Further, according to the gateway fuse control method of the present invention, in the step SO2, when no system abnormality is detected, the external network system periodically sends heartbeat information to the internal network system through the data line; the tracking of the external network system abnormality includes receiving the system abnormality information and not receiving the heartbeat information sent by the external network system.

[0011] Further, according to the gateway fuse control method of the present invention, the method further includes step SI3; Step SI3: When an abnormality is detected in the external network system, the internal network system sends a warning to the staff.

[0012] Further, according to the gateway fuse control method of the present invention, the content monitored for monitoring whether there is a system abnormality includes: device resource occupation, abnormal process startup, abnormal file writing, abnormal permission change, abnormal network connection, and virus identification.

[0013] Further, according to the gateway fuse control method of the present invention, the data line realizes data communication between the external network system and the internal network system through a dual-port random access memory, or realizes data communication between the external network system and the internal network system through Ethernet.

[0014] The technical effects of the present invention are as follows: by setting a fuse switch on the data line between the intranet and the extranet, and by monitoring the system status of the extranet system, if there is an abnormal state, the fuse switch is directly cut off, thereby isolating the security risks outside the intranet at the first time to ensure the security of the intranet network. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 It is a flow chart of gateway security fuse control according to an embodiment of the present invention.

[0016] Figure 2 and Figure 3 Schematic diagram of fuse switch connection in two implementation modes of the present invention. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below with reference to the accompanying drawings.

[0018] Figure 2 and Figure 3 Two implementations of the gateway with internal and external network fuses of the present invention are illustrated. The gateway includes two relatively independent computer systems: an internal network system and an external network system. The internal network system is configured in an internal network or a private network, and the external network system is configured in an external network or a public network. As two independent computer systems, the internal network system and the external network system adopt the von Neumann computer system familiar to those skilled in the art, and are respectively composed of independent processors, memories, and other facilities. More specifically, the internal network system includes a connected processor and memory and an internal network communication module connected to the processor; the external network system includes a connected processor and memory and an external network communication module connected to the processor. Among them, the internal network communication module and the external network communication module are usually Ethernet communication modules, or more commonly called network cards. The internal network system and the external network system are connected via data lines. The data line between the internal network system and the external network system can be used in many ways, such as Figure 2 Example of dual-port memory, such as Figure 3The example of direct connection between network communication modules. For details on the method of realizing communication between the intranet system and the extranet system using a dual-port memory, please refer to patent document CN 107018154 A. Figure 3 The example network communication module is an Ethernet communication module, that is, Figure 3 The data line between the internal network system and the external network system is realized by directly connecting the network cable. In other optional implementations, for example, the data line between the internal network system and the external network system is realized by optical fiber in optical transmission.

[0019] In the present invention, a fuse switch is provided on the data line between the intranet system and the extranet system. The fuse switch may be a relay or other electronic switch, and is used to cut off the data line between the intranet system and the extranet system. Figure 2 In the exemplary implementation, the fuse switch is an electronic switch set on the power line of the dual-port memory. When the fuse switch is cut off, the dual-port memory loses power and cannot store, read or write data, thereby cutting off the data line between the intranet system and the extranet system. Figure 3 In the exemplary implementation, the fuse switch is directly arranged on the network cable connecting the internal network system and the external network system, so as to directly cut off the network cable to cut off the data line between the internal network system and the external network system.

[0020] The fuse switch provided on the data line between the intranet system and the external network system is connected to the intranet system, more specifically, to the processor of the intranet system. Figure 2 In the exemplary implementation, the fuse switch is an electronic switch provided on the power line of the dual-port memory, and is usually arranged on a circuit board. The fuse switch is directly connected to the processor of the intranet system through the wiring on the circuit board. Figure 3 In an exemplary implementation, the intranet system processor and the fuse switch are usually connected via a serial port communication method.

[0021] In order to realize the control of the fuse switch fusing and cutting, the external network system is equipped with a system abnormality monitoring module and a system abnormality sending module. The internal network system is equipped with a system abnormality tracking module and a fuse switch control module. The system abnormality monitoring module is used to: monitor whether there are system abnormalities; The system abnormality sending module is used to: when the system abnormality monitoring module detects that there is a system abnormality, send the system abnormality information to the intranet system through the data line; The system exception tracking module is used to: track external network system exceptions by receiving system exception information; The fuse switch control module is used to instruct the fuse switch to cut off the data line between the internal network system and the external network system when an abnormality in the external network system is tracked.

[0022] The system anomaly here refers to the system anomaly related to security. The system anomaly monitoring module monitors whether there is a system anomaly, including but not limited to: device resource occupancy, abnormal process startup, abnormal file writing, abnormal permission change, abnormal network connection, and virus identification. The device resources here are usually processors, memory and network ports. That is, the processor occupancy rate, memory occupancy rate and network port communication occupancy rate are used to determine whether there is a system anomaly. When the external network system is attacked from the Internet, the occupancy rate of the processor, memory and network port communication may soar. The excessive occupancy rate of the processor, memory and network port communication must mean an external attack, so it can be judged as a system anomaly. In addition, as a dedicated computer system, the external network system has fixed running processes and readable and writable files. Processes and abnormal file operations beyond this fixed range mean that there is an external attack, so it can be judged as a system anomaly. Similarly, if there is an abnormal change in operating system permissions or an abnormal network connection or a virus, it can be judged that the external network system is under external attack and is judged as a system anomaly.

[0023] The intranet system's tracking of the external network system anomaly cannot be directly equated with receiving the system anomaly information. Tracking the external network system anomaly cannot be equated with receiving the system anomaly information sent by the external network system. In addition to the external network system receiving the system anomaly information sent by the external network system, there is also the situation where the external network system is disconnected. That is to say, tracking the external network system anomaly includes the external network system being disconnected or receiving the system anomaly information. In this embodiment, monitoring whether the external network system is disconnected is judged by the heartbeat information. That is, in the system anomaly sending module, when the system anomaly monitoring module does not detect the system anomaly, the heartbeat information is sent to the intranet system regularly through the data line; tracking the external network system anomaly includes receiving the system anomaly information and not receiving the heartbeat information sent by the external network system. The failure to receive the heartbeat information sent by the external network system here indicates that the external network system is disconnected. At this time, the system anomaly tracking module receives the heartbeat information in addition to receiving the system anomaly information. If the system anomaly tracking module does not receive the heartbeat information for a time limit of more than a certain length, it indicates that the external network system is disconnected, that is, the heartbeat information sent by the external network system is not received.

[0024] In addition, the embodiment preferably further configures a system abnormality alarm module in the intranet system, and the system abnormality alarm module is used to: when an abnormality of the external network system is tracked, issue a warning prompt to the staff. The warning indication here can be various ways such as issuing an alarm sound, displaying an alarm indication on the screen, or sending a short message.

[0025] After the fuse switch is cut off, the subsequent recovery and maintenance of the gateway is not within the scope of the present invention and need not be elaborated.

[0026] In addition, the process of cooperation between the above-mentioned system abnormality monitoring module, system abnormality sending module, system abnormality tracking module, fuse switch control module and system abnormality alarm module constitutes the gateway fuse control method referred to in the present invention, such as Figure 1 As shown, the process is as follows: when the external network system detects a system anomaly, it sends it to the internal network system. The internal network system tracks the system anomaly of the external network system by receiving the system anomaly. When the external network system anomaly is tracked, the fuse switch is instructed to cut off the data line between the internal network system and the external network system. Specifically in this embodiment, the gateway fuse control method includes the following steps: Step SO1: the external network system monitors whether there is any system abnormality; Step SO2: When a system abnormality is detected, the external network system sends system abnormality information to the internal network system through the data line; Step SI1: The intranet system tracks the anomaly of the external network system by receiving system anomaly information; Step SI2: When an abnormality in the external network system is detected, the internal network system instructs the fuse switch to cut off the data line between the internal network system and the external network system.

[0027] Step SI3: When an abnormality is detected in the external network system, the internal network system sends a warning to the staff.

[0028] Steps SO1, SO2, SI1, SI2 and SI3 correspond to the system abnormality monitoring module, the system abnormality sending module, the system abnormality tracking module, the fuse switch control module and the system abnormality alarm module respectively.

[0029] It should be pointed out that in the present embodiment, steps SO1, SO2, SI1, SI2 and SI3 or the system abnormality monitoring module, the system abnormality sending module, the system abnormality tracking module, the fuse switch control module and the system abnormality alarm module are all implemented by computer programs. More specifically, steps SO1 and SO2, or the system abnormality monitoring module and the system abnormality sending module are implemented by the external network system through its processor executing the computer program instruction set stored in the memory; steps SI1, SI2 and SI3, or the system abnormality tracking module, the fuse switch control module and the system abnormality alarm module are implemented by the internal network system through its processor executing the computer program instruction set stored in the memory. Those skilled in the art understand that the above steps and modules can also be implemented in other circuit forms.

Claims

1. A gateway with internal and external network fuses, comprising an internal network system for connecting to an internal network and an external network system for connecting to an external network, wherein the internal network system and the external network system are connected via a data line; characterized in that: A fuse switch is provided on the data line between the intranet system and the external network system; the fuse switch is connected to the intranet system via a control line; the external network system is provided with a system abnormality monitoring module and a system abnormality sending module; the intranet system is provided with a system abnormality tracking module and a fuse switch control module; The system abnormality monitoring module is used to: monitor whether there is a system abnormality; The system abnormality sending module is used to: when the system abnormality monitoring module detects that there is a system abnormality, send system abnormality information to the intranet system through the data line; The system abnormality tracking module is used to: track external network system abnormalities by receiving system abnormality information; The fuse switch control module is used to instruct the fuse switch to cut off the data line between the internal network system and the external network system when an abnormality in the external network system is tracked.

2. The gateway with internal and external network fuse according to claim 1, characterized in that: The data line realizes data communication between the external network system and the internal network system through a dual-port random access memory, or realizes data communication between the external network system and the internal network system through Ethernet.

3. The gateway with internal and external network fuse according to claim 1, characterized in that: In the system abnormality sending module, when the system abnormality monitoring module does not detect the system abnormality, heartbeat information is periodically sent to the internal network system through the data line; tracking the external network system abnormality includes receiving the system abnormality information and not receiving the heartbeat information sent by the external network system.

4. The gateway with internal and external network fuse according to claim 1, characterized in that: The monitoring of whether there is a system anomaly includes: device resource usage, abnormal process startup, abnormal file writing, abnormal permission change, abnormal network connection, and virus identification.

5. The gateway with internal and external network fuse according to claim 1, characterized in that: The intranet system is also configured with a system abnormality alarm module; the system abnormality alarm module is used to: when an abnormality of the external network system is tracked, issue a warning prompt to the staff.

6. A gateway fuse control method, characterized in that: The gateway includes an intranet system for connecting to an intranet and an extranet system for connecting to an extranet, wherein the intranet system and the extranet system are connected via a data line; a fuse switch is provided on the data line between the intranet system and the extranet system; the fuse switch is connected to the intranet system via a control line; the method includes the following steps: Step SO1: the external network system monitors whether there is any system abnormality; Step SO2: When a system abnormality is detected, the external network system sends system abnormality information to the internal network system through the data line; Step SI1: The intranet system tracks the anomaly of the external network system by receiving system anomaly information; Step SI2: When an abnormality in the external network system is detected, the internal network system instructs the fuse switch to cut off the data line between the internal network system and the external network system.

7. The gateway fuse control method according to claim 6, characterized in that: In step SO2, when no system abnormality is detected, the external network system periodically sends heartbeat information to the internal network system through the data line; tracking the external network system abnormality includes receiving system abnormality information and not receiving heartbeat information sent by the external network system.

8. The gateway fuse control method according to claim 6, characterized in that: The method further comprises step SI3; Step SI3: When an abnormality is detected in the external network system, the internal network system sends a warning to the staff.

9. The gateway fuse control method according to claim 6, characterized in that: The monitoring of whether there is a system anomaly includes: device resource usage, abnormal process startup, abnormal file writing, abnormal permission change, abnormal network connection, and virus identification.

10. The gateway fuse control method according to claim 6, characterized in that: The data line realizes data communication between the external network system and the internal network system through a dual-port random access memory, or realizes data communication between the external network system and the internal network system through Ethernet.

Images