Novel network isolation data processing system and method

Abstract

The novel network isolation data processing system comprises a plurality of network isolation password board cards which are connected in parallel, and each network isolation password board card comprises an internal network processing unit based on a trusted CPU, a multi-channel isolation processing unit based on an FPGA and an external network processing unit based on the trusted CPU. According to the invention, by deploying a plurality of physical isolation board cards and a data processing task scheduling mechanism, stable and reliable work can still be realized under the condition that a certain unit fails, and the problem of single-point failure of common network isolation equipment is effectively solved; the power consumption of the network isolation password equipment is reduced by combining a low-power-consumption mode of an isolation board card chip, the service life of the equipment is prolonged, and the trend requirement of strict data secrecy of a data system is met. The application of the invention has good social benefits and application prospects, and can promote the development of the network isolation data encryption technology in the field of information security to a certain extent.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular to a novel network isolation data processing system and method. Background Art

[0002] With the rapid development of network technology, many enterprises and government agencies have prepared or built their own internal networks, established internal information processing systems, and accessed external networks through various means. Various data information is frequently exchanged between internal and external networks in large quantities. Due to the security risks brought by the vulnerability of TCP / IP network protocols and operating systems, which cannot be eliminated, internal and external networks are currently subject to increasingly serious network attacks, interfering with the normal operation of internal information processing systems; network isolation equipment has become a bridge connecting data exchange between internal and external networks. At present, most network isolation equipment has problems such as low data exchange transmission rate and frequent equipment failures, which seriously interfere with data interaction between internal and external networks. Therefore, the high reliability, high stability and high efficiency of network isolation cryptographic equipment have become a very important link in ensuring internal network security. Summary of the invention

[0003] The purpose of the present invention is to overcome the shortcomings of the prior art and propose a new network isolation data processing system and method, which can increase the rate of data interaction between internal and external networks, ensure the data security of internal and external networks, and at the same time improve the stability and reliability of the operation of network isolation equipment, and effectively solve the problems of untimely response of physical isolation equipment, data transmission congestion, equipment paralysis, etc. in the process of massive data exchange between internal and external networks.

[0004] The present invention solves the technical problem by adopting the following technical solutions:

[0005] A novel network isolation data processing system is installed between an internal integrated network and an external integrated network, and includes a plurality of network isolation password boards connected in parallel. The network isolation password boards include: an internal network processing unit based on a trusted CPU, a multi-channel isolation processing unit based on an FPGA, and an external network processing unit based on a trusted CPU. The multi-channel isolation processing unit based on the FPGA is connected through the internal network processing units between two adjacent network isolation password cards through a 10 Gigabit network; and the external network processing units between two adjacent network isolation password cards are connected through a 10 Gigabit network.

[0006] Moreover, the data in the internal network processing unit based on the trusted CPU is sent to the external network processing unit based on the trusted CPU after being encrypted by the isolation algorithm and identity authentication and data authentication encryption by the multi-channel isolation processing unit based on the FPGA, thereby ensuring the security of data in the low security domain; the data in the external network processing unit based on the trusted CPU is authenticated by the external network processing unit, and then sent to the multi-channel isolation processing unit based on the FPGA for isolation algorithm decryption, and then sent to the internal network processing unit based on the trusted CPU.

[0007] A novel processing method for a network isolation data processing system includes a method for transferring external network data flow to an internal network and a method for transferring internal network data flow to an external network.

[0008] Moreover, the method for transferring the external network data flow to the internal network includes the following steps:

[0009] Step 1, external data is sent to the external network processing unit of the network isolation password board 1 of the network isolation password device (at the external network IP address 0) through the external network information system;

[0010] Step 2: The external network processing unit sends a receipt message to the external network information processing system; if the external network information processing system does not receive the receipt message within a specified time, the external network information processing system considers that the external network processing unit is faulty;

[0011] Step 3, after the above-mentioned external network processing unit fails, the external network information system will send the message to the external network processing unit of the network isolation password board 2 (at the external network No. 1 IP address);

[0012] Step 4: The external network processing unit performs protocol identification on external data based on the trusted computing environment, filters out message data that does not comply with the dedicated protocol, filters out malicious code attack message data through identity authentication, access control and data authentication, and realizes dynamic identity authentication and identity verification of message data;

[0013] Step 5: Calculate the packet flow rate F of the external network processing unit. When F < the packet flow rate threshold F of a single processing unit M When the network isolation password board 1 works normally, the network isolation password board external network processing unit sends the processed data to the isolation processing unit. The remaining boards enter low-power sleep mode to reduce power consumption and improve system reliability;

[0014] Step 6: The external network processing unit of the network isolation password board sends the processed data to multiple isolation authentication channels of the isolation processing unit for data decryption processing. The message data is evenly distributed to n isolation authentication channels for synchronous processing to increase the data exchange rate;

[0015] Step 7: When F> single processing unit message flow threshold F M When the external network processing unit of network isolation password board 1 sends a heartbeat message to the external network processing unit of network isolation password board 2 through the 10G network, waking up network isolation password board 2 from low power consumption mode to process the message data. If the receipt message returned by network isolation password board 2 to network isolation password board 1 is not received within the specified time, the external network processing unit is deemed to be faulty, and the message data will be sent to the external network processing unit of network isolation password board 3, and so on;

[0016] Step 8: The network processing unit inside the network isolation password board receives the decrypted data, and splices the data packets according to the dedicated protocol, integrates the data, and conducts a security audit.

[0017] Furthermore, the method for transferring the internal network data flow to the external network comprises the following steps:

[0018] Step 1: The internal network information system sends the internal data to the internal network processing unit, and the internal network processing unit performs security audit and protocol identification on the internal data;

[0019] Step 2: Send the data to the isolation processing unit for multi-channel data encryption processing and then send it to the external network processing unit;

[0020] Step 3: The external network processing unit performs identity authentication and access control algorithm encryption on the data encrypted by the isolation authentication based on the secure and trusted environment built by the trusted CPU to ensure the security of the data;

[0021] Step 4: Send the twice-encrypted data to the external network information system.

[0022] The advantages and positive effects of the present invention are:

[0023] The present invention can achieve stable and reliable operation even when a certain unit fails by deploying multiple physical isolation boards and data processing task scheduling mechanisms, effectively solving the single point failure problem of common network isolation equipment; combined with the low power consumption mode of the isolation board chip, the power consumption of the network isolation cryptographic equipment is reduced, and the service life of the equipment is increased, which meets the trend of strict confidentiality of data in the data system. The application of the present invention has good social benefits and application prospects, and can promote the development of network isolation data encryption technology in the field of information security to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a system structure diagram of the present invention;

[0025] Figure 2 This is a flow chart of data message feedback information of the network isolation cryptographic device of the present invention;

[0026] Figure 3 This is a data exchange flow chart of the network isolation cryptographic data processing system of the present invention. DETAILED DESCRIPTION

[0027] The present invention is further described in detail below with reference to the accompanying drawings.

[0028] A new network isolation data processing system, such as Figure 1 As shown, it is installed between the internal integrated network and the external integrated network, including multiple network isolation password boards in parallel, the network isolation password boards include: an internal network processing unit based on a trusted CPU, a multi-channel isolation processing unit based on an FPGA, and an external network processing unit based on a trusted CPU. The multi-channel isolation processing unit based on the FPGA is connected through the internal network processing units between two adjacent network isolation password cards through a 10 Gigabit network; the external network processing units between two adjacent network isolation password cards are connected to each other through a 10 Gigabit network.

[0029] The data in the internal network processing unit based on the trusted CPU is encrypted by the isolation algorithm and identity authentication and data authentication encryption by the multi-channel isolation processing unit based on the FPGA, and then sent to the external network processing unit based on the trusted CPU to ensure the security of data in the low security domain; the data in the external network processing unit based on the trusted CPU is authenticated by the external network processing unit, and then sent to the multi-channel isolation processing unit based on the FPGA for isolation algorithm decryption, and then sent to the internal network processing unit based on the trusted CPU.

[0030] The FPGA-based multi-channel isolation processing unit can ensure the normal development of high-reliability and high-stability data processing work. At the same time, a new processing method for network isolation data processing system is implemented based on a new data processing task scheduling mechanism. A new data processing task scheduling mechanism can ensure that large quantities of data can be quickly exchanged between internal and external networks in a short period of time, reducing user waiting time and improving work efficiency.

[0031] Multiple internal network processing units in the network isolation password device are set with different internal network IP addresses (increasing in sequence), and different internal network processing units are interconnected through a 10G network. Multiple external network processing units in the network isolation password device are set with different external network IP addresses (increasing in sequence), and different external network processing units are interconnected through a 10G network.

[0032] Set the transmission network data packet length to be fixed at K bytes, and the single isolation authentication channel of the network isolation board can process a maximum of M packets of network data. Then the amount of message data that can be processed by a single isolation channel is K*M, and the N isolation authentication channels of a single network isolation board can complete the encryption, decryption, authentication and transmission of N*K*M bytes of data at a time.

[0033] Therefore, the threshold value of the message data flow that can be transmitted and processed by the internal / external network processing unit of a single network isolation board is F M =N*K*M.

[0034] When the single data transmission flow F of the internal / external network processing unit is greater than F M When the network isolation board is disconnected, the remaining message data will be sent to the network processing unit at the next network IP address for data encryption, decryption, authentication and transmission.

[0035] The present invention adopts a data message feedback mechanism between multiple network processing units, such as Figure 2 As shown, heartbeat messages and receipt messages are added to realize the wake-up and sleep of network isolation password devices, further reduce the power consumption of equipment operation, and improve the reliability of the system.

[0036] When the network information system needs to exchange data, it needs to send a heartbeat message to the network processing unit of the network isolation password device to wake up the network processing unit for data processing. At the same time, the network processing unit will send a receipt message to the network information system.

[0037] When the data flow rate F of a network isolation card in the network isolation password device is greater than F M When the network isolation board is started, it will send a heartbeat message to the other network isolation boards to wake up the network isolation boards for data processing, and at the same time receive a receipt message to confirm that the other network isolation boards have started data processing.

[0038] A novel processing method for network isolation data processing system, such as Figure 3 As shown, it includes a method for transferring external network data flow to an internal network and a method for transferring internal network data flow to an external network.

[0039] The process of transferring data from the external network to the internal network includes the following steps:

[0040] ①: External data is sent to the external network processing unit of the network isolation password board 1 of the network isolation password device (at the external network IP address 0) through the external network information system.

[0041] ②: The external network processing unit sends a receipt message to the external network information processing system; if the external network information processing system does not receive the receipt message within the specified time (sent 3 times in a row), the external network information processing system considers that the external network processing unit is faulty.

[0042] ③: After the above external network processing unit fails, the external network information system will send the message to the external network processing unit of the network isolation password board 2 (at the external network IP address No. 1)

[0043] ④: The external network processing unit performs protocol identification on external data based on the trusted computing environment, filters out message data that does not comply with the dedicated protocol, filters out malicious code attack message data through identity authentication, access control and data authentication, and realizes dynamic identity authentication and identification of message data.

[0044] ⑤: Calculate the message flow F of the external network processing unit (at the external network IP address 0). When F < the message flow threshold F of a single processing unit M When the network isolation password board 1 works normally, the network isolation password board external network processing unit sends the processed data to the isolation processing unit. The remaining boards enter low-power sleep mode to reduce power consumption and improve system reliability.

[0045] ⑥: The external network processing unit of the network isolation password board sends the processed data to multiple isolation authentication channels of the isolation processing unit for data decryption processing. The message data is evenly distributed to n isolation authentication channels for synchronous processing to increase the data exchange rate.

[0046] ⑦: When F> single processing unit message flow threshold F M When the external network processing unit of network isolation password board 1 sends a heartbeat message to the external network processing unit of network isolation password board 2 through the 10G network, the network isolation password board 2 is awakened from the low power consumption mode to process the message data. If the receipt message returned by network isolation password board 2 to network isolation password board 1 is not received within the specified time (sent 3 times in a row), the external network processing unit is deemed to be faulty, and the message data will be sent to the external network processing unit of network isolation password board 3, and so on.

[0047] ⑧: The network processing unit inside the network isolation password board receives the decrypted data, and splices the data packets according to the dedicated protocol, integrates the data, and conducts security audits.

[0048] The process of transferring data from the internal network to the external network is the opposite of the above process:

[0049] ①: The internal network information system sends the internal data to the internal network processing unit, and the internal network processing unit performs security audit and protocol identification on the internal data.

[0050] ②: Send the data to the isolation processing unit for multi-channel data encryption processing and then send it to the external network processing unit.

[0051] ③: The external network processing unit performs identity authentication and access control algorithm encryption (secondary encryption) on the data encrypted by isolation authentication based on the secure and trusted environment built by the trusted CPU to ensure data security.

[0052] ④: Send the twice-encrypted data to the external network information system.

[0053] It should be emphasized that the embodiments described in the present invention are illustrative rather than restrictive. Therefore, the present invention includes but is not limited to the embodiments described in the specific implementation manner. Any other implementation manners derived by those skilled in the art based on the technical solution of the present invention also fall within the scope of protection of the present invention.

Claims

1. A new type of network isolation data processing system, installed between the internal integrated network and the external integrated network, characterized by: It includes multiple network isolation password boards connected in parallel, and the network isolation password boards include: an internal network processing unit based on a trusted CPU, a multi-channel isolation processing unit based on an FPGA, and an external network processing unit based on a trusted CPU. The internal network processing units between two adjacent network isolation password cards are interconnected through a 10 Gigabit network; the external network processing units between two adjacent network isolation password cards are interconnected through a 10 Gigabit network.

2. A novel network isolation data processing system according to claim 1, characterized in that: The data in the internal network processing unit based on the trusted CPU is encrypted by the isolation algorithm and identity authentication and data authentication encryption by the multi-channel isolation processing unit based on FPGA, and then sent to the external network processing unit based on the trusted CPU to ensure the security of data in the low security domain; the data in the external network processing unit based on the trusted CPU is authenticated by the external network processing unit, and then sent to the multi-channel isolation processing unit based on FPGA for isolation algorithm decryption, and then sent to the internal network processing unit based on the trusted CPU.

3. A processing method of the novel network isolation password data processing system according to any one of claims 1 to 2, characterized in that: It includes a method for transferring data from an external network to an internal network and a method for transferring data from an internal network to an external network.

4. The processing method of a novel network isolation data processing system according to claim 3 is characterized in that: The method for transferring external network data flow to internal network includes the following steps: Step 1, external data is sent to the external network processing unit of the network isolation password board 1 of the network isolation password device through the external network information system; Step 2: The external network processing unit sends a receipt message to the external network information processing system; if the external network information processing system does not receive the receipt message within a specified time, the external network information processing system considers that the external network processing unit is faulty; Step 3, after the above-mentioned external network processing unit fails, the external network information system will send the message to the external network processing unit of the network isolation password board 2; Step 4: The external network processing unit performs protocol identification on external data based on the trusted computing environment, filters out message data that does not comply with the dedicated protocol, filters out malicious code attack message data through identity authentication, access control and data authentication, and realizes dynamic identity authentication and identity verification of message data; Step 5: Calculate the packet flow rate F of the external network processing unit. When F < the packet flow rate threshold F of a single processing unit M When the network isolation password board 1 works normally, the network isolation password board external network processing unit sends the processed data to the isolation processing unit, and the other boards enter the low-power sleep mode to reduce power consumption and improve system reliability; Step 6: The external network processing unit of the network isolation password board sends the processed data to multiple isolation authentication channels of the isolation processing unit for data decryption processing, and evenly distributes the message data to n isolation authentication channels for synchronous processing to increase the data exchange rate; Step 7: When F> single processing unit message flow threshold F M When the external network processing unit of network isolation password board 1 sends a heartbeat message to the external network processing unit of network isolation password board 2 through the 10 Gigabit network, the network isolation password board 2 is awakened from the low power consumption mode to process the message data. If the receipt message returned by network isolation password board 2 to network isolation password board 1 is not received within the specified time, the external network processing unit is deemed to be faulty, and the message data will be sent to the external network processing unit of network isolation password board 3, and so on. Step 8: The network processing unit inside the network isolation password board receives the decrypted data, splices the data packets according to the dedicated protocol, integrates the data, and performs a security audit.

5. The processing method of a novel network isolation data processing system according to claim 3 is characterized in that: The method for transferring the internal network data flow to the external network comprises the following steps: Step 1: The internal network information system sends the internal data to the internal network processing unit, and the internal network processing unit performs security audit and protocol identification on the internal data; Step 2: Send the data to the isolation processing unit for multi-channel data encryption processing and then send it to the external network processing unit; Step 3: The external network processing unit performs identity authentication and access control algorithm encryption on the data encrypted by the isolation authentication based on the secure and trusted environment built by the trusted CPU to ensure the security of the data; Step 4: Send the twice-encrypted data to the external network information system.

Images