Controllable unidirectional light transmission device

Abstract

The invention provides a controllable one-way optical transmission device, which belongs to the technical field of optical communication, and comprises the following steps: a first one-way transmission unit receives signal light carrying application data; the safety control unit receives the signal light transmitted by the first one-way transmission unit, and allows the signal light to pass when the data safety check is passed; the second one-way transmission unit sends the signal light passing through the safety control unit to the light receiving unit; signal light is transmitted in the first one-way transmission unit and the second one-way transmission unit in a one-way mode. According to the invention, the safety control unit is additionally arranged between the optical transmitting unit and the optical receiving unit, and the optical transmitting unit and the optical receiving unit are unidirectionally isolated to form a safe and credible intermediate domain, so that the reliability of a safety strategy is ensured, and the safety of the optical transmitting unit which is directly reachable by a network is not dependent on any more; the problem of passive leakage is thoroughly solved, state data such as heartbeat packets and synchronization frames do not penetrate through network boundaries any more, and the possibility that time type hidden channels do not exist any more.

Description

Technical Field

[0001] The present invention relates to the field of optical communication technology, and in particular to a controllable unidirectional optical transmission device. Background Art

[0002] The traditional optical one-way transmission system generally consists of only three parts: an optical sending unit, a one-way transmission unit, and an optical receiving unit. The one-way transmission unit consists of an optical sending card and an optical receiving card, which are connected by a physical optical fiber to form an optical one-way channel.

[0003] In order to achieve the demand for safe and controllable one-way high-speed data transmission across networks, some security companies in the industry have proposed using one-way optical technology to solve the problem of importing external network data into the internal network. That is, the external network link uses one-way optical gate technology, combined with automatic security inspection and data labeling technology to ensure that only data that has passed the security inspection and has been marked and inspected is transmitted to the internal network in a one-way manner. This solution solves the problem of automatically and efficiently importing external network data, but its defects are also obvious, mainly manifested in: (1) The one-way optical gate always maintains a real-time ready transmission channel in one direction and has the ability to transmit network status in addition to application data, thus easily forming a time-based covert channel.

[0004] (2) We cannot hope to block all sensitive or attack-type data before it is transmitted through logical control measures.

[0005] (3) The inner and outer ends of the one-way optical gate are both accessible through the network, and various security policies can be modified and bypassed. As long as the attack on the data sending host is successful, the system security can be easily compromised. Therefore, this solution has structural defects.

[0006] (4) The communication capability of a one-way optical gate is too strong, and it can easily become a link carrier for cross-network loop attacks together with the reverse channel (between a high-sensitivity network and a low-sensitivity network). Summary of the invention

[0007] The present invention provides a controllable unidirectional optical transmission device, which solves the problem that the unidirectional optical gate always maintains a real-time ready transmission channel in one direction, has the ability to transmit network status in addition to application data, and is prone to forming a time-type covert channel. By adopting a new transmission architecture, the security control unit is set between two unidirectional transmission units, which is inaccessible to both the optical sending unit and the optical receiving unit, and becomes an independent and trusted computing unit, ensuring that various security policies implemented on the security control unit can be faithfully executed without being controlled or interfered by the outside world, solving the structural defects of the traditional unidirectional optical gate that both the sending end and the receiving end are network accessible, various security policies can be modified and bypassed, and the system security is easily lost as long as the attack on the data sending end host is successful.

[0008] The present invention provides a controllable unidirectional optical transmission device, which specifically comprises: a first unidirectional transmission unit, which receives the signal light carrying the application data sent by the optical sending unit; a security control unit, the security control unit receiving the signal light transmitted by the first unidirectional transmission unit, performing a data security check on the application data carried by the signal light, and continuing to send the signal light carrying the application data backward if the data security check passes; a second unidirectional transmission unit, which transmits the signal light passing through the safety control unit to a light receiving unit; The signal light is unidirectionally transmitted in both the first unidirectional transmission unit and the second unidirectional transmission unit.

[0009] According to a controllable unidirectional optical transmission device provided by the present invention, the first unidirectional transmission unit and the second unidirectional transmission unit both include: An optical unidirectional transmission card for collimating the signal light; An optical reverse isolator receives the signal light after the first collimation processing of the optical unidirectional sending card, transmits the signal light transmitted in the forward direction to the optical unidirectional receiving card, and isolates the signal light transmitted in the reverse direction; The optical unidirectional receiving card focuses the received signal light transmitted in the forward direction; The forward-transmitted signal light is a direction from the optical transmitting unit to the optical receiving unit, and the reverse-transmitted signal light is a signal light that is opposite to the propagation direction of the forward-transmitted signal light.

[0010] According to a controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator comprises: At least one set of polarization rotator components, wherein the polarization rotator components include a polarizer and an optical rotator arranged in sequence on a forward transmission optical path; A magnetic ring body, coaxially arranged outside the polarization rotator component, and the magnetic field direction of the magnetic ring body is the same as the direction of the forward transmission light path; An isolation polarizer, located between the last set of polarization rotator components and the output end of the optical reversal isolator; The polarized light formed by the forward-transmitted signal light after passing through each of the polarization rotator components has the same polarization direction as the isolation polarizer; The reversely transmitted signal light incident from the isolation polarizer will be orthogonal to the polarization direction of the polarizer of the polarization rotator assembly after passing through the rotator of each polarization rotator assembly.

[0011] According to a controllable unidirectional optical transmission device provided by the present invention, the polarization rotator component comprises a first polarization rotator component and a second polarization rotator component sequentially arranged on the optical path of forward transmission; The first polarization rotator assembly includes a first polarizer and a first optical rotator, wherein the polarization direction of the first polarizer is perpendicular to the optical path of the input end of the first polarization rotator assembly, and the first optical rotator rotates the vertically polarized light passing through the first polarizer to a horizontal direction; The second polarization rotator assembly includes a second polarizer and a second rotator, the polarization direction of the second polarizer is perpendicular to the output end optical path of the first polarization rotator assembly, and the second rotator rotates the horizontally polarized light passing through the second polarizer to be consistent with the polarization direction of the isolation polarizer.

[0012] According to a controllable unidirectional light transmission device provided by the present invention, the polarization rotator component and the isolation polarizer are both located in the YZ plane, the angle between the polarization direction of the first polarizer and the X-axis is 90°, the angle between the polarization direction of the second polarizer and the X-axis is 0°, the angle between the polarization direction of the isolation polarizer and the X-axis is 45°, the optical rotation angle of the first optical rotator is 90° clockwise, and the optical rotation angle of the second optical rotator is 45° clockwise.

[0013] According to a controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator further includes: An input pigtail, one end of which is connected to the optical fiber input interface of the optical reverse isolator, and the other end of which is aligned with the first collimator; An output pigtail, one end of which is connected to the optical fiber output interface of the optical reverse isolator, and the other end of which is aligned with the second collimator; In the optical path direction of the forward transmission of the signal light, the first collimator is located in front of the first polarizer, and the second collimator is located behind the isolation polarizer.

[0014] According to a controllable unidirectional optical transmission device provided by the present invention, at least one of the optical reverse isolators is an enhanced optical reverse isolator; The enhanced optical reverse isolator further comprises: An aperture, the aperture being arranged on the optical path of the enhanced optical reverse isolator, and the safety control unit being communicatively connected with the aperture through a control interface of the aperture; The safety control unit decides the opening or closing of the aperture by running a data transmission channel control strategy, so as to control the transmission of the signal light in the enhanced optical reverse isolator.

[0015] According to a controllable unidirectional optical transmission device provided by the present invention, the data transmission channel control strategy includes one or more of a working period control strategy, a manual control strategy and a batch transmission control strategy.

[0016] According to a controllable unidirectional optical transmission device provided by the present invention, the enhanced optical reverse isolator further includes: a safety control lock; When the safety control lock is in a locked state, the aperture is forced to remain closed; When the safety control lock is in an unlocked state, the safety control unit is enabled to control the opening or closing of the aperture.

[0017] According to a controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator in the second unidirectional transmission unit is the enhanced optical reverse isolator.

[0018] According to a controllable unidirectional optical transmission device provided by the present invention, the security control unit performs a data security check on the signal light, including a data security check on the application data carried by the signal light.

[0019] According to a controllable unidirectional optical transmission device provided by the present invention, the data security check on the application data carried by the signal light includes: One or more of virus and Trojan horse check, data integrity check, data format check, data content check and data label check.

[0020] The controllable unidirectional optical transmission device provided by the present invention adds a security control unit between the optical sending unit and the optical receiving unit, which is unidirectionally isolated for the optical sending unit and the optical receiving unit to form a safe and reliable intermediate domain, thereby ensuring the reliability of the security policy, no longer relying on the security of the optical sending unit directly accessible by the network, and completely solving the problem of passive leakage. There is no longer any status data such as heartbeat packets and synchronization frames that penetrate the network boundary, and there is no possibility of time-based covert channels. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 It is a structural schematic diagram of a unidirectional optical transmission device used in the prior art.

[0023] Figure 2This is one of the structural schematic diagrams of the controllable unidirectional optical transmission device provided by the present invention.

[0024] Figure 3 This is one of the structural schematic diagrams of the unidirectional transmission unit provided by the present invention.

[0025] Figure 4 This is the second structural schematic diagram of the controllable unidirectional optical transmission device provided by the present invention.

[0026] Figure 5 This is one of the structural schematic diagrams of the optical reverse isolator provided by the present invention.

[0027] Figure 6 This is the second structural schematic diagram of the optical reverse isolator provided by the present invention.

[0028] Figure 7 It is a schematic diagram of the optical axis propagation direction provided by the present invention.

[0029] Figure 8 It is a schematic diagram of the forward transmission of signal light in the optical reverse isolator provided by the present invention.

[0030] Fig. 9 It is a schematic diagram of the reverse transmission of signal light in the optical reverse isolator provided by the present invention.

[0031] Fig.10 This is the third structural schematic diagram of the controllable unidirectional optical transmission device provided by the present invention.

[0032] Fig.11 This is the third structural schematic diagram of the optical reverse isolator provided by the present invention.

[0033] Fig.12 This is the fourth structural schematic diagram of the optical reverse isolator provided by the present invention.

[0034] Fig.13 This is the fifth structural schematic diagram of the optical reverse isolator provided by the present invention.

[0035] Fig.14 It is a structural schematic diagram of the safety control unit provided by the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] It should be noted that in the description of the present invention, the terms "include", "comprise" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "include one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. The orientation or position relationship indicated by the terms "upper", "lower", "front", "rear", etc. is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation of the present invention. Unless otherwise clearly specified and limited, the terms "installed", "connected" and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection, an electrical connection or a communication connection; it can be directly connected, or indirectly connected through an intermediate medium, or it can be a connection between two elements. For those skilled in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0038] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, and are not used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same type, and the number of objects is not limited. For example, the first object can be one or more. In addition, "and / or" means at least one of the connected objects, and the character " / " generally indicates that the objects associated with each other are in an "or" relationship.

[0039] Figure 1 is a schematic diagram of the structure of a unidirectional optical transmission device used in the prior art, such as Figure 1 As shown in the figure, the traditional optical one-way transmission system mainly consists of three parts: optical transmission unit (mainly including light-emitting module), one-way transmission unit, and optical receiving unit (mainly including photosensitive module). Among them, the one-way transmission unit is mainly composed of optical transmission card and optical receiving card, which are connected by physical optical fiber to form a one-way optical fiber channel.

[0040] In general, the currently widely used unidirectional optical transmission devices have two main deficiencies: First, the traditional one-way optical transmission system simply uses optical fiber isolation devices such as light-emitting modules, physical optical fibers, and photosensitive modules, relying on the characteristics that the light-emitting module can only emit light and the photosensitive module can only receive light to achieve unidirectional data transmission. At the same time, since the photosensitive module cannot emit light and the light-emitting module cannot receive light, there will be no physical carrier in the reverse direction, so there will be no reverse data leakage, but this logic faces two problems: Question 1: The above logic relies on the unidirectionality of the information source, that is, the isolation device is always correctly installed: the light-emitting module is installed in the light-transmitting unit, the photosensitive module is installed in the light-receiving unit, and the light-emitting module can only emit light, and the photosensitive module can only sense light. However, the production of optical fiber modules follows international standards. A general optical fiber module, if not specially processed, integrates the ability to emit light and sense light. Even if the light-emitting module or the photosensitive module is removed, the appearance and size are the same. The light-emitting module and the photosensitive module may be installed reversely due to misoperation during the production process, that is, the light-emitting module may be installed in the light-receiving unit and the photosensitive module may be installed in the light-transmitting unit, thereby destroying the unidirectionality of the information source.

[0041] Question 2: Once the unidirectionality of the information source is destroyed, the physical optical fiber, as a light propagation medium, fully supports bidirectional communication.

[0042] Secondly, in order to achieve the demand for secure and controllable one-way high-speed data transmission across networks, some security companies in the industry have proposed using one-way optical technology to solve the problem of importing external network data into the internal network, that is, using one-way optical gate technology in the external network link, combined with automatic security inspection and data labeling technology, to ensure that only data that has passed the security inspection and has been marked and inspected is transmitted to the internal network in a one-way manner. Although this solution solves the security problem of automatically and efficiently importing external network data, its defects are also obvious, mainly manifested in: (1) The one-way optical gate always maintains a real-time ready transmission channel in one direction and has the ability to transmit network status in addition to application data, thus easily forming a time-based covert channel.

[0043] (2) It is not possible to block all sensitive or attack-type data before transmission through logical control alone.

[0044] (3) Because both the inner and outer ends of the one-way optical switch are accessible through the network, various security policies can be modified and bypassed. As long as the attack on the data sending host is successful, the security of the entire one-way optical transmission system can be easily compromised. Therefore, the current solution has structural defects.

[0045] (4) The communication capability of a one-way optical gate is too strong, and it can easily become a link carrier for cross-network loop attacks together with the reverse channel (between a high-sensitivity network and a low-sensitivity network).

[0046] In view of this, there is an urgent need to improve the existing unidirectional optical transmission system to provide a safer, more reliable and controllable unidirectional optical transmission device to address the security loopholes in the existing technology and prevent data leakage and unauthorized access.

[0047] Combine the following Figure 2-Figure 14 The controllable unidirectional optical transmission device provided by the present invention is described.

[0048] Figure 2 is one of the structural schematic diagrams of the controllable unidirectional optical transmission device provided by the present invention, such as Figure 2 As shown, it mainly includes but is not limited to the following components: A first unidirectional transmission unit for receiving signal light carrying application data sent by an optical sending unit, a security control unit for receiving the signal light transmitted by the first unidirectional transmission unit, performing a data security check on the signal light, and allowing the signal light to pass if the data security check passes, and a second unidirectional transmission unit for sending the signal light passing through the security control unit to an optical receiving unit.

[0049] Specifically, the controllable unidirectional optical transmission device provided by the present invention mainly realizes unidirectional transmission and security control of signal light through a three-level architecture, and its core components and the connection relationship between these core components include but are not limited to: (1) The first unidirectional transmission unit, whose main function is to serve as the transmitting end entrance of the signal light and receive the initial signal light from the optical sending unit.

[0050] (2) A security control unit is added as a trusted intermediate domain in the unidirectional optical transmission device. The security control unit is independent of the optical sending unit and the optical receiving unit and is used to perform data security checks. For example, data security checks are performed on the application data carried by the received signal light, virus and Trojan scans are performed on the application data, and application data integrity checks are performed. The security control unit can only allow signal light that has passed all security checks to enter the next transmission stage.

[0051] The security control unit can be connected to the first unidirectional transmission unit and the second unidirectional transmission unit through an optical fiber interface, and no direct network path is established between the optical sending unit and the optical receiving unit, which can effectively prevent the data security check policy running in the security control unit from being tampered with externally.

[0052] (3) A second unidirectional transmission unit, serving as a receiving end outlet of the signal light, is used to unidirectionally transmit the signal light that has passed the security check to the light receiving unit.

[0053] The first unidirectional transmission unit and the second unidirectional transmission unit serve as unidirectional transmission units (ie, signal light is unidirectionally transmitted in the first unidirectional transmission unit and the second unidirectional transmission unit), and mainly include an optical unidirectional sending card, an optical reverse isolator and an optical unidirectional receiving card.

[0054] Among them, the optical one-way sending card is mainly used to collimate the input signal light and convert it into a parallel light beam.

[0055] The optical reverse isolator is designed based on Faraday's magneto-optical crystal effect and Malus's law. It mainly ensures that the signal light can only be transmitted in the forward direction through the combination of polarization rotator components and magnetic rings, while the signal light transmitted in the reverse direction is completely isolated.

[0056] The specific operation process of the controllable unidirectional optical transmission device provided by the present invention is described below in conjunction with a specific embodiment: The external network server sends out a signal light carrying application data through the optical sending unit, and the signal light enters the security control unit after being collimated by the first unidirectional transmission unit.

[0057] The security control unit will perform a data security check on the application data carried by the incoming signal light. For example, it will first scan the application data for viruses to check whether it carries malicious code. It will then perform an integrity check on the application data by comparing the data hash value of the application data with the digital signature pre-stored in the optical sending unit. Finally, it can also confirm the disclosure level of the application data through the classification and grading labels of the application data.

[0058] After completing the data security check on the signal light, the security control unit allows the signal light to pass through and enter the second unidirectional transmission unit if it is confirmed that the result of the data security check is normal.

[0059] On the contrary, if the result of the data security check is abnormal (for example, the signal light carries unauthorized confidential data), the security control unit will block the continued transmission of the signal light and generate an alarm log to send to the external network server and / or the internal network server.

[0060] After being collimated by the second unidirectional transmission unit, the signal light enters the light receiving unit of the intranet and is finally parsed and stored by the intranet server.

[0061] By using the controllable unidirectional optical transmission device provided by the present invention, since the security control unit only allows the transmission of data that has passed the inspection, it can effectively cut off the time-based and statistical covert channels. In this way, even if the external network server is invaded, the attacker cannot reversely obtain the data in the internal network server through the security control unit.

[0062] In addition, since the optical reverse isolator used is constructed based on the Faraday magneto-optical effect, its reverse isolation can reach 70dB, and the reverse optical signal power can be attenuated to one ten-millionth of the original power.

[0063] The controllable unidirectional optical transmission device provided by the present invention adds a security control unit between the optical sending unit and the optical receiving unit, which is unidirectionally isolated for the optical sending unit and the optical receiving unit to form a safe and reliable intermediate domain, thereby ensuring the reliability of the security policy, no longer relying on the security of the optical sending unit directly accessible by the network, and completely solving the problem of passive leakage. There is no longer any status data such as heartbeat packets and synchronization frames that penetrate the network boundary, and there is no possibility of time-based covert channels.

[0064] Based on the content of the above embodiment, as an optional embodiment, the first unidirectional transmission unit and the second unidirectional transmission unit both include: One-way optical transmission card, used to collimate the signal light; The optical reverse isolator is used to receive the signal light after the first collimation processing of the optical unidirectional sending card, and transmit the forward-transmitted signal light therein to the optical unidirectional receiving card, but isolate the reverse-transmitted signal light therein; The optical one-way receiving card is mainly used to focus the received forward transmitted signal light.

[0065] The forward transmitted signal light refers to the direction from the optical transmitting unit to the optical receiving unit, and the reverse transmitted signal light refers to the signal light in the opposite direction of propagation to the forward transmitted signal light.

[0066] Figure 3 is one of the structural schematic diagrams of the unidirectional transmission unit provided by the present invention, such as Figure 3 As shown, as unidirectional transmission units, the internal structures of the first unidirectional transmission unit and the second unidirectional transmission unit are mainly composed of three components: an optical unidirectional sending card, an optical reverse isolator and an optical unidirectional receiving card.

[0067] The optical unidirectional sending card serves as a shaper of the signal light at the transmitting end, including a collimating lens or a collimating lens group (such as an aspheric lens or a fiber collimator). It receives the signal light from the optical sending unit (the signal light at this time is generally a divergent light beam), and uses the collimating lens or the collimating lens group to convert the divergent signal light into a parallel light beam, thereby reducing the transmission loss and making the light beam entering the optical reverse isolator controllable.

[0068] The role of the optical reverse isolator in the entire unidirectional transmission unit is to achieve complete isolation of the forward and reverse transmission of the signal light, that is, to transmit the forward transmitted signal light to the optical unidirectional receiving card, and to isolate the possible reverse transmission signal light. The input end of the optical reverse isolator is connected to the optical unidirectional sending card through optical fiber, and the output end of the optical reverse isolator is connected to the optical unidirectional receiving card through optical fiber.

[0069] Optionally, the optical reverse isolator mainly screens the signal light of a specific polarization direction through a combination of polarizers, and then uses an optically active material (such as terbium-doped glass) to change the polarization direction of the light. After the forward-transmitted signal light is screened by the polarizer, only the component of a specific polarization direction is retained. The optically active material rotates the polarization direction by a preset angle (such as 90° or 45°). After multi-level regulation, the polarization direction of the signal light matches the polarizer at the output end, and the signal light can pass.

[0070] Correspondingly, the reversely transmitted signal light (such as the signal light entering through the output end of the optical reverse isolator) is adjusted by the polarizer combination so that the propagation direction of the signal light is orthogonal to the polarizer near the input end of the optical reverse isolator. In this way, the reversely transmitted signal light is completely isolated due to polarization mismatch and cannot enter the optical unidirectional sending card.

[0071] The optical unidirectional receiving card is located at the output end of the unidirectional transmission unit, and its input end is coupled with the output end of the optical reverse isolator, and the output end is connected to the optical receiving unit through an optical fiber. The optical unidirectional receiving card mainly includes a group of focusing lenses (such as gradient refractive index lenses or self-focusing lenses) to focus the signal light output by the optical reverse isolator. After receiving the collimated light beam output by the optical reverse isolator, it focuses the parallel collimated light beam into a point light source to adapt to the photoelectric detector at the receiving end.

[0072] The optical unidirectional receiving card can compensate for the spot divergence effect in optical fiber transmission, ensure the stability of the optical power at the receiving end, and reduce the risk of signal-to-noise ratio degradation caused by mismatch of spot size.

[0073] Figure 4 FIG. 2 is a second schematic diagram of the structure of the controllable unidirectional optical transmission device provided by the present invention. Figure 4 As shown, the controllable unidirectional optical transmission device of this embodiment adopts a three-stage cascade architecture, and a first unidirectional transmission unit, a safety control unit, and a second unidirectional transmission unit are sequentially arranged on the optical path of the signal light transmitted in the forward direction. Among them, the input end of the first unidirectional transmission unit is connected to the optical fiber of the optical transmission unit, and the output end of the first unidirectional transmission unit is connected to the safety control unit; the input end of the second unidirectional transmission unit is connected to the safety control unit, and its output end is connected to the optical fiber of the optical receiving unit.

[0074] The operation process of the above controllable unidirectional optical transmission device may be: 1) The external device (such as a server or terminal device) converts the electrical signal into signal light through the optical transmission unit, and transmits the signal light to the optical unidirectional transmission card of the first unidirectional transmission unit through the optical fiber.

[0075] 2) The optical unidirectional sending card collimates the incoming divergent signal light and outputs a parallel light beam to the optical reverse isolator.

[0076] 3) The optical reverse isolator filters the forward-transmitting signal light in the parallel light beam and blocks the reverse-transmitting signal light that may exist therein.

[0077] 4) The signal light transmitted in the forward direction through the optical reverse isolator enters the security control unit to perform a data security check.

[0078] 5) If the security check is passed, the signal light passing through is collimated by the optical unidirectional sending card of the second unidirectional transmission unit, and the possible reverse transmission signal light is further isolated by the optical reverse isolator, and finally focused by the optical unidirectional receiving card of the second unidirectional transmission unit and sent to the optical receiving unit.

[0079] Based on the above operation process, it can be found that any optical signal that attempts to transmit in the reverse direction from the receiving end (such as the optical receiving unit) will be physically intercepted by the optical reverse isolator in the second unidirectional transmission unit and the first unidirectional transmission unit, and the transmittance is close to zero, effectively achieving physical layer isolation. In addition, the reversely transmitted optical signal will also be isolated at the logical level through the security control unit, and the security control unit is deployed independently to prevent the relevant device policies running in the security control unit from being bypassed by the optical sending unit / optical receiving unit.

[0080] The controllable unidirectional optical transmission device provided by the present invention utilizes the optical device characteristics of the unidirectional transmission unit to compensate for the security risks caused by possible protocol loopholes or configuration errors in the security control unit. At the same time, by simultaneously arranging the first unidirectional transmission unit and the second unidirectional transmission unit on both sides of the security control unit, even if one unidirectional transmission unit fails, the optical reverse isolator in the other unidirectional transmission unit can still block the signal light of the reverse transmission.

[0081] It should be noted that, in the controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator used can be designed based on the Faraday magneto-optical crystal effect and Malus's law.

[0082] Among them, the Faraday magneto-optical crystal effect describes the transmission of linearly polarized light in a medium. If a strong magnetic field is applied parallel to its propagation direction, its vibration direction will be deflected. The deflection angle θ is proportional to the product of the Verdet constant V of the optically active body, the magnetic induction intensity B and the medium length L, that is: θ=VBL.

[0083] Malus's law describes that after linearly polarized light passes through a polarizer, the intensity of the transmitted light is I=I0cos2 θ. Where θ is the angle between the light vibration direction of the incident linearly polarized light and the polarization direction of the polarizer, and I0 is the intensity of the incident linearly polarized light.

[0084] Figure 5 This is one of the structural schematic diagrams of the optical reverse isolator provided by the present invention. Figure 5 As shown, a specific structure of a controllable unidirectional optical transmission device is provided. The controllable unidirectional optical transmission device includes a first unidirectional transmission unit, a safety control unit and a second unidirectional transmission unit. The first unidirectional transmission unit and the second unidirectional transmission unit both include an optical unidirectional transmission card, an optical reverse isolator and the optical unidirectional receiving card.

[0085] Optionally, an optical reverse isolator provided in this embodiment mainly includes but is not limited to: at least one group of polarization rotator components, wherein the polarization rotator components include a polarizer and an optical rotator sequentially arranged on the optical path of forward transmission; a magnetic ring body coaxially arranged outside the polarization rotator component, and the magnetic field direction of the magnetic ring body is the same as the direction of the optical path of forward transmission; and an isolation polarizer located between the last group of polarization rotator components and the output end of the optical reverse isolator.

[0086] The polarized light formed by the forward-transmitting signal light after passing through each polarization rotator component is the same as the polarization direction of the isolation polarizer. The reverse-transmitting signal light incident from the isolation polarizer will be orthogonal to the polarization direction of the polarizer of the polarization rotator component after passing through the rotator of each polarization rotator component.

[0087] The optical reverse isolator realizes the unidirectional transmission of signal light and complete isolation of the reverse direction through the cooperation of polarization rotator components, magnetic rings and isolation polarizers. Its structure and working principle are as follows: The polarization rotator assembly includes a polarizer and an optical rotator, wherein the polarizer is used to filter light signals with a specific polarization direction (such as vertical polarization). The optical rotator is made of a crystalline material that changes the polarization direction of light based on the Faraday magneto-optical effect. At least one polarizer and at least one optical rotator constitute a polarization rotator assembly.

[0088] Optionally, the polarization rotator components in an optical reverse isolator can be a group, or multiple groups of polarization rotator components can be arranged in series on the optical path, so as to adjust the input light to an angle matching the output end isolation polarizer by rotating the polarization direction step by step, and at the same time use reverse rotation to make the polarization direction of the reversely transmitted signal light orthogonal to the polarizer close to the input end, thereby achieving physical blocking.

[0089] The magnetic ring is a structure that surrounds the polarization rotator and can provide a constant magnetic field for the polarization rotator. The strength of the constant magnetic field can be set according to the actual polarization rotation needs, generally within the range of 0.5T~1.0T. The magnetic field direction of the constant magnetic field is generally strictly consistent with the optical path direction of the signal light in the forward transmission of the optical reverse isolator to ensure the stability of the optical rotation effect of the optical rotator.

[0090] The purpose of the magnetic ring body to provide a constant magnetic field is to activate the Faraday magneto-optical effect so that the rotation angle of the optical rotator to the polarization of light meets the requirements. For example, the rotation angle of the optical rotator to the polarization of light can be adjusted by adjusting the magnetic ring parameters of the magnetic ring body (such as magnetic field strength and length) to optimize the isolation performance of the optical reverse isolator.

[0091] Isolation polarizers can use high extinction ratio polarizers. For example, if quartz material is selected, its extinction ratio can be greater than 10 6 : 1. The polarization direction of the isolation polarizer is generally fixed. For example, if the isolation polarizer is selected with a polarization direction of 45° to the X-axis, it allows the signal light obliquely transmitted at 45° to pass through. When the isolation polarizer is used to isolate the reversely transmitted signal light, the optical path direction of the reversely transmitted signal light can be adjusted to be orthogonal to the polarization direction of the isolation polarizer through the polarization rotator component, and then its transmittance approaches zero.

[0092] As another optional embodiment, Figure 6 As shown, in the controllable unidirectional optical transmission device provided by the present invention, it mainly includes a magnetic ring body arranged outside the polarization rotation component, an isolation polarizer close to the output end of the optical reverse isolator, and the polarization rotation component.

[0093] Two groups of polarization rotator components are arranged in each optical reverse isolator, specifically including a first polarization rotator component and a second polarization rotator component which are sequentially arranged on the optical path of forward transmission.

[0094] The first polarization rotator assembly includes a first polarizer and a first rotator. The polarization direction of the first polarizer is perpendicular to the input end optical path of the first polarization rotator assembly. The first rotator rotates the vertically polarized light passing through the first polarizer to a horizontal direction.

[0095] The second polarization rotator assembly includes a second polarizer and a second rotator. The polarization direction of the second polarizer is perpendicular to the output end optical path of the first polarization rotator assembly. The second rotator rotates the horizontally polarized light passing through the second polarizer to be consistent with the polarization direction of the isolation polarizer.

[0096] In this embodiment, the first polarizer in the first polarization rotator is perpendicular to the input end optical path, and is used to filter out vertically polarized light and suppress horizontally polarized light noise. The first rotator is used to rotate the filtered vertically polarized light 90° clockwise to the horizontal direction.

[0097] The second polarizer in the second polarization rotator is perpendicular to the output optical path of the previous stage (first polarization rotator), further screening out horizontal polarized light and suppressing vertical polarized light noise. The second rotator is used to rotate horizontal polarized light 45° clockwise to 45° oblique polarized light to match the isolation polarizer.

[0098] Since the isolation polarizer is set to have a polarization direction of 45° obliquely, it allows 45° oblique light to pass through, but completely reflects or absorbs signal light in other polarization directions.

[0099] Figure 7 is a schematic diagram of the optical axis propagation direction provided by the present invention, as an optional embodiment, such as Figure 7 As shown, assuming that the light propagates along the X-axis, the polarization rotator component and the isolation polarizer are both located in the YZ plane, the angle between the polarization direction of the first polarizer and the X-axis is 90°, the angle between the polarization direction of the second polarizer and the X-axis is 0°, the angle between the polarization direction of the isolation polarizer and the X-axis is 45°, the optical rotation angle of the first optical rotator is 90° clockwise, and the optical rotation angle of the second optical rotator is 45° clockwise.

[0100] Figure 8 Schematic diagram of the forward transmission of signal light in the optical reverse isolator provided by the present invention, such as Figure 8 As shown, when the signal light perpendicular to the YZ plane (generally including vertical and horizontal components) passes through the first polarizer, since the polarization direction of the first polarizer is vertical (the angle with the X-axis is 90°), the angle θ between the polarization direction of the signal light passing through the first polarizer and the Y-axis is 0.

[0101] Furthermore, after the signal light passes through the first optical rotator, the first optical rotator rotates the polarization direction of the polarized light 90° clockwise to be parallel to the Z axis (θ=90°). At this time, the optical axis direction of the signal light coincides with the polarization direction of the second polarizer, and it will pass through the second polarizer and enter the second optical rotator.

[0102] When the signal light passes through the second optical rotator, the polarization direction of the polarized light continues to rotate 45° clockwise, becoming a signal light at 45° to the Y axis. At this time, the optical axis direction of the signal light coincides with the polarization direction of the isolation polarizer near the output end (optical reverse isolator), and it will also transmit through the isolation polarizer. Finally, the signal light will enter the optical one-way receiving card for focusing and output.

[0103] Fig. 9 Schematic diagram of the reverse transmission of signal light in the optical reverse isolator provided by the present invention, such as Fig. 9As shown, when the signal light perpendicular to the YZ plane is the signal light transmitted in the direction, it will enter from the isolation polarizer. Since the polarization direction of the isolation polarizer is at an angle of 45° to the Y axis, the polarization direction of the signal light transmitted through the isolation polarizer becomes at an angle of 45° to the Y axis.

[0104] Furthermore, the signal light will pass through the second optical rotator, which will rotate it 45° clockwise. At this time, the angle between the polarization direction of the signal light passing through the second optical rotator and the Y axis is 0 (θ=0°), which is just orthogonal to the polarization direction of the second polarizer. According to Malus's law, the intensity of the signal light transmitted through the second polarizer will theoretically become 0. Assume that there are some errors in the actual process, and a small amount of signal light passes through the second polarizer.

[0105] In order to further enhance the reverse isolation of light, the small portion of signal light transmitted through the second polarizer will pass through the first optical rotator, which will rotate it 45° clockwise. The polarization direction of the obtained signal light is parallel to the Z axis (θ=90°), which is just orthogonal to the polarization direction of the first polarizer. The intensity of the transmitted signal light theoretically becomes 0, further suppressing the propagation of the reverse transmitted signal light.

[0106] The controllable unidirectional optical transmission device provided by the present invention not only adopts an optical fiber channel with a reverse isolator, but also solves the problem that once the unidirectionality of the signal source of the traditional optical gate is destroyed, the optical fiber cable, as a light propagation medium, fully supports two-way communication. At the same time, on the basis of adopting a two-stage cascaded optical unidirectional transmission unit, at least two groups of polarization rotation components are configured for the optical reverse isolator in each optical unidirectional transmission unit, which fundamentally solves the problem that the logic of the traditional optical gate depends on the unidirectionality of the signal source, resulting in the unidirectionality of the signal source being destroyed due to misoperation in the production process, and the transmission channel of the reverse light is cut off to the greatest extent, thereby enhancing the reliability and controllability of the unidirectional transmission channel.

[0107] Combination Figure 5 or Figure 6 As shown, in the controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator includes, in addition to the polarization rotator assembly, magnetic ring body, isolation polarizer and other components introduced in the above embodiments, the following components are also included: An input pigtail, one end of which is connected to the optical fiber input interface of the optical reverse isolator, and the other end of which is aligned with the first collimator; An output pigtail, one end of which is connected to the optical fiber output interface of the optical reverse isolator, and the other end of which is aligned with the second collimator; In the optical path direction of the forward transmission of the signal light, the first collimator is located in front of the first polarizer, and the second collimator is located behind the isolation polarizer.

[0108] Specifically, the present invention provides a dual-pigtail collimator coupling structure to achieve efficient transmission of optical signals and precise optical path alignment in an isolator, while solving the insertion loss fluctuation problem of traditional isolators caused by the tilt of the optical fiber end face.

[0109] The input pigtail can use LC / UPC fiber connector, and the end face can use chemical-mechanical polishing (CMP) process to reduce the surface roughness. The output pigtail is compatible with the input pigtail, and both can support hot plug operation.

[0110] The first collimator and the second collimator generally use aspheric lenses. The first collimator is installed in front of the first polarizer (along the optical path direction of forward propagation) to collimate the divergent light beam output by the pigtail into parallel light, reducing the reflection loss on the surface of the polarizer. The second collimator is installed within a certain distance behind the isolation polarizer to calibrate the oblique signal light transmitted by the isolation polarizer so that it can be output in parallel to the receiving end optical fiber.

[0111] In order to further address the risks of reverse optical signal injection attacks or optical path misoperation that may exist in optical communication systems, the present invention provides an enhanced optical reverse isolator based on aperture control, which realizes real-time safety management of the optical path through an integrated electrically controlled aperture and a safety control unit, ensuring that signal light is transmitted only under authorized conditions, while supporting remote fault diagnosis and emergency fuse functions.

[0112] The controllable unidirectional optical transmission device provided by the present invention mainly includes core components such as a first unidirectional transmission unit, a safety control unit, and a second unidirectional transmission unit, wherein the first unidirectional transmission unit and the second unidirectional transmission unit are both composed of an optical unidirectional sending card, an optical reverse isolator, and an optical unidirectional receiving card. The optical reverse isolator of at least one of the first unidirectional transmission unit and the second unidirectional transmission unit can be upgraded to an enhanced optical reverse isolator including aperture control.

[0113] Fig.10 FIG. 3 is a schematic diagram of the structure of the controllable unidirectional optical transmission device provided by the present invention. Fig.10 As shown, the optical reverse isolator in the second unidirectional transmission unit is upgraded to an enhanced optical reverse isolator.

[0114] After upgrading to the enhanced optical reverse isolator, the security control unit controls the opening and closing of the aperture through the security controller according to the data transmission channel control strategy, and physically controls the data transmission channel. For example, a data transmission channel that is only ready during the working period can effectively prevent cross-network loop attacks, cut off the link-level state transmission and response capabilities, and only retain the data controlled and secure transmission capabilities.

[0115] In addition, the optical reverse isolator in the first unidirectional transmission unit may be upgraded to an enhanced optical reverse isolator, or the optical reverse isolators in the first unidirectional transmission unit and the second unidirectional transmission unit may be upgraded to enhanced optical reverse isolators at the same time.

[0116] Fig.11 This is the third structural schematic diagram of the optical reverse isolator provided by the present invention, which shows a common optical reverse isolator. Fig.12 This is the fourth structural schematic diagram of the optical reverse isolator provided by the present invention, which shows an enhanced optical reverse isolator with an aperture and other supporting structures added.

[0117] like Fig.12 As shown, the enhanced optical reverse isolator mainly includes components such as an input end, an isolation layer, an aperture, a control interface and an output end. Its implementation method for suppressing light reverse transmission is consistent with that of an ordinary optical reverse isolator. The difference lies in the addition of an aperture and a control interface. The physical on-off control of the transmission channel of the signal light is achieved by controlling the opening and closing of the aperture through the safety control unit, thereby having the physical on-off control capability of the transmission channel.

[0118] The aperture in the present invention adopts a fully light-blocking aperture. When the aperture blades are in a closed state, they can completely block the central area of ​​the aperture blades to achieve the effect of fully blocking the light. Specifically, it can be composed of a metal alloy frame wrapped with a liquid crystal dimming film, and has an axially symmetrical design. The size of the aperture (including inner diameter, outer diameter, thickness, etc.) is mainly based on the size of the optical fiber bundle that adapts the signal light. For example, when the core diameter is 6μm, the aperture size that can be selected is: inner diameter is Φ2mm, outer diameter is Φ5mm, and thickness is 1mm.

[0119] In the actual optical path, the aperture is set between the isolation polarizer and the second collimator. The aperture can be fixed in the housing of the optical reverse isolator by a micro spring clamping ring and supports ±0.1mm axial displacement compensation.

[0120] The hardware of the security control unit mainly includes independent CPU, operating system, hard disk, input / output interface and other components. Its software function mainly realizes data security check of the one-way receiving and sending unit according to the security policy, including virus Trojan, data integrity, data format, data content, data label and other security checks. The data that passes the check is sent to the optical receiving unit through the second optical one-way transmission unit. At the same time, the unit also has functions such as system management, log recording, behavior auditing, data transmission channel control strategy, and data security check strategy configuration.

[0121] The safety control unit can generally be installed outside the housing of the optical reverse isolator and connected to the aperture control interface through an optical fiber interface.

[0122] like Fig.12 As shown, when the aperture is in a normally open state, the aperture light transmission area is aligned with the optical path axis.

[0123] Fig.13 5 is a schematic diagram of the structure of the optical reverse isolator provided by the present invention, such as Fig.13 As shown, when the aperture is in the closed state, the aperture baffle will completely block the light path and the light spot will be cut off. The controllable unidirectional light transmission device provided by the present invention can achieve microsecond response by adjusting the light path through the aperture, which is 3 orders of magnitude faster than the traditional mechanical switch.

[0124] In the controllable unidirectional optical transmission device provided by the present invention, the security control unit can control the opening and closing of the aperture through the security controller according to the data transmission channel control strategy, and physically switch the data transmission channel, and only keep the data transmission channel ready during the working period, which solves the problem that the one-way optical gate is easy to become a link carrier for cross-network loop attacks. The innovative use of a one-way transmission channel with physical on-off control capability solves the problem that the one-way optical gate always maintains a real-time ready transmission channel in one direction, has the ability to transmit network status in addition to application data, and is easy to form a time-type covert channel.

[0125] Fig.14 is a schematic diagram of the structure of the safety control unit provided by the present invention, such as Fig.14 As shown, the device strategies run by the security control unit provided by the present invention mainly include data security inspection strategies and data transmission channel control strategies. Among them, the data transmission channel control strategies mainly include working period control strategies, manual control strategies, batch transmission control strategies, etc.

[0126] Among them, the working period control strategy refers to controlling the opening and closing state of the aperture according to the preset time window (such as 00:00-06:00 is the non-working period mode), thereby controlling the on and off of the data transmission channel at the physical level, thereby ensuring the security of the transmission channel.

[0127] The manual control strategy refers to a strategy that allows the reviewer or manager to review and control the transmission task and the opening and closing state of the aperture through the Web interface. It should be noted that the manual control strategy can adopt hierarchical authority management, such as dividing all reviewers or managers into multiple levels such as system administrators, auditors, department heads, and ordinary users, and setting different manual control permissions between different levels.

[0128] The batch transmission control strategy refers to opening a transmission channel for batch data transmission for data files in a specific format (such as fixed-format XML files, JSON files, etc.) under specific conditions.

[0129] by Fig.10Taking the controllable unidirectional optical transmission device shown as an example, according to the data transmission channel control strategy pre-set for the safety control unit, the physical on-off control of the transmission channel is achieved by controlling the opening or closing of the aperture of the second unidirectional transmission unit (located between the safety control unit and the light receiving unit).

[0130] If the working period control strategy is set to the daily working period (such as 09:00~20:00), during this working period, the security control unit will control the aperture to open and open the transmission channel to prevent illegal data transmission without supervision. The manual control strategy can be set to require manual review of the application data carried by the optical signal. After the manual review is passed, the aperture will be manually opened to ensure controlled data transmission. The batch transmission control strategy can be set to open the transmission channel for batch transmission of data files in a specific format under specific conditions.

[0131] The security control unit is also responsible for performing data security checks on the signal light, including data security checks on the application data carried by the signal light, mainly including: virus and Trojan checks, data integrity checks, data format checks, data content checks, and data label checks.

[0132] For virus and Trojan inspection, the virus library (such as ClamAV virus library, supporting CVE vulnerability signature library) can be integrated in the security control unit to detect application data and match virus signature codes. The application data can also be downloaded to the local sandbox (ARM Cortex-A72 processor) to perform virtual operation and monitor API call behavior. When it is detected that the application data contains high-risk virus features, the transmission of the optical signal can be blocked in real time by controlling the aperture to close, triggering a fuse alarm.

[0133] For data integrity checking, the hash value of the application data carried by the optical signal can be calculated by the security control unit, and the calculation result can be compared with the hash value carried in its task to prevent the application data from being tampered with.

[0134] For data format checking, it can include parsing the file format suffix and actual format of the application data for in-depth format checking.

[0135] For data content inspection, keyword scanning, semantic analysis, and other methods can be used to detect whether the application data contains abnormal content such as sensitive words.

[0136] For data tag checking, the signature identity and authority of the application data transmitted by the optical signal can be determined through digital signature verification or source data verification.

[0137] To summarize, the controllable unidirectional optical transmission device provided by the present invention can perform data security checks on signal light through a security control unit, perform network protocol analysis and application layer data stripping on all transmitted application data based on the data security check results, and perform virus and Trojan horse checks and data integrity checks, thereby achieving the purpose of blocking all sensitive or attack data before transmission.

[0138] As an optional embodiment, the present invention also configures a safety control lock for each enhanced optical reverse isolator. When the safety control lock is in a locked state, the aperture is forced to remain closed; when the safety control lock is in an unlocked state, the safety control unit is enabled to control the opening or closing of the aperture.

[0139] The safety control lock is a prerequisite for opening the aperture. If the safety control lock is opened, the aperture can be opened by the safety control unit. If the safety control lock is locked, the safety control unit cannot open the aperture, which plays a role in physical manual control of the channel and further enhances the reliability and controllability of the one-way transmission channel.

[0140] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0141] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0142] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A controllable unidirectional optical transmission device, characterized in that: include: a first unidirectional transmission unit, which receives the signal light carrying the application data sent by the optical sending unit; a security control unit, which receives the signal light transmitted by the first unidirectional transmission unit, performs a data security check on the signal light, and allows the signal light to pass if the data security check passes; a second unidirectional transmission unit, which transmits the signal light passing through the safety control unit to a light receiving unit; The signal light is unidirectionally transmitted in both the first unidirectional transmission unit and the second unidirectional transmission unit.

2. The controllable unidirectional optical transmission device according to claim 1, characterized in that: The first unidirectional transmission unit and the second unidirectional transmission unit both include: An optical unidirectional transmission card for collimating the signal light; An optical reverse isolator receives the signal light after the first collimation processing of the optical unidirectional sending card, transmits the signal light transmitted in the forward direction to the optical unidirectional receiving card, and isolates the signal light transmitted in the reverse direction; The optical unidirectional receiving card focuses the received signal light transmitted in the forward direction; The forward-transmitted signal light is a direction from the optical transmitting unit to the optical receiving unit, and the reverse-transmitted signal light is a signal light that is opposite to the propagation direction of the forward-transmitted signal light.

3. The controllable unidirectional optical transmission device according to claim 2, characterized in that: The optical reverse isolator comprises: At least one set of polarization rotator components, wherein the polarization rotator components include a polarizer and an optical rotator arranged in sequence on a forward transmission optical path; A magnetic ring body, coaxially arranged outside the polarization rotator component, and the magnetic field direction of the magnetic ring body is the same as the direction of the forward transmission light path; An isolation polarizer, located between the last set of polarization rotator components and the output end of the optical reversal isolator; The polarized light formed by the forward-transmitted signal light after passing through each of the polarization rotator components has the same polarization direction as the isolation polarizer; The reversely transmitted signal light incident from the isolation polarizer will be orthogonal to the polarization direction of the polarizer of the polarization rotator assembly after passing through the rotator of each polarization rotator assembly.

4. The controllable unidirectional optical transmission device according to claim 3, characterized in that: The polarization rotator assembly comprises a first polarization rotator assembly and a second polarization rotator assembly which are sequentially arranged on the optical path of forward transmission; The first polarization rotator assembly includes a first polarizer and a first optical rotator, wherein the polarization direction of the first polarizer is perpendicular to the optical path of the input end of the first polarization rotator assembly, and the first optical rotator rotates the vertically polarized light passing through the first polarizer to a horizontal direction; The second polarization rotator assembly includes a second polarizer and a second rotator, the polarization direction of the second polarizer is perpendicular to the output end optical path of the first polarization rotator assembly, and the second rotator rotates the horizontally polarized light passing through the second polarizer to be consistent with the polarization direction of the isolation polarizer.

5. The controllable unidirectional optical transmission device according to claim 4, characterized in that: The polarization rotator assembly and the isolation polarizer are both located in the YZ plane, the angle between the polarization direction of the first polarizer and the X-axis is 90°, the angle between the polarization direction of the second polarizer and the X-axis is 0°, the angle between the polarization direction of the isolation polarizer and the X-axis is 45°, the optical rotation angle of the first optical rotator is 90° clockwise, and the optical rotation angle of the second optical rotator is 45° clockwise.

6. The controllable unidirectional optical transmission device according to claim 4, characterized in that: The optical reverse isolator further comprises: An input pigtail, one end of which is connected to the optical fiber input interface of the optical reverse isolator, and the other end of which is aligned with the first collimator; An output pigtail, one end of which is connected to the optical fiber output interface of the optical reverse isolator, and the other end of which is aligned with the second collimator; In the optical path direction of the forward transmission of the signal light, the first collimator is located in front of the first polarizer, and the second collimator is located behind the isolation polarizer.

7. The controllable unidirectional optical transmission device according to any one of claims 2 to 6, characterized in that: At least one of the optical reverse isolators is an enhanced optical reverse isolator; The enhanced optical reverse isolator further comprises: An aperture, the aperture being arranged on the optical path of the enhanced optical reverse isolator, and the safety control unit being communicatively connected with the aperture through a control interface of the aperture; The safety control unit decides the opening or closing of the aperture by running a data transmission channel control strategy, so as to control the transmission of the signal light in the enhanced optical reverse isolator.

8. The controllable unidirectional optical transmission device according to claim 7, characterized in that: The data transmission channel control strategy includes one or more of a working period control strategy, a manual control strategy and a batch transmission control strategy.

9. The controllable unidirectional optical transmission device according to claim 7, characterized in that: The enhanced optical reverse isolator further includes: a safety control lock; When the safety control lock is in a locked state, the aperture is forced to remain closed; When the safety control lock is in an unlocked state, the safety control unit is enabled to control the opening or closing of the aperture.

10. The controllable unidirectional optical transmission device according to claim 7, characterized in that: The optical reverse isolator in the second unidirectional transmission unit is the enhanced optical reverse isolator.

11. The controllable unidirectional optical transmission device according to claim 1, characterized in that: The security control unit performs a data security check on the signal light, including a data security check on the application data carried by the signal light.

12. The controllable unidirectional optical transmission device according to claim 11, characterized in that: The data security check on the application data carried by the signal light includes: One or more of virus and Trojan horse check, data integrity check, data format check, data content check and data label check.

Images