Controllable Unidirectional Optical Transmission Device

Abstract

The present invention provides a controllable unidirectional optical transmission device, belonging to the field of optical communication technology, comprising: a first unidirectional transmission unit that receives signal light carrying application data; a security control unit that receives the signal light transmitted by the first unidirectional transmission unit and allows the signal light to pass through when the data security check is passed; a second unidirectional transmission unit that sends the signal light passing through the security control unit to an optical receiving unit; the signal light is unidirectionally transmitted in both the first unidirectional transmission unit and the second unidirectional transmission unit. By adding a security control unit between the optical transmitting unit and the optical receiving unit, the present invention forms a secure and trusted intermediate domain that is unidirectionally isolated from both the optical transmitting unit and the optical receiving unit, ensuring the reliability of the security policy, no longer relying on the security of the optical transmitting unit directly reachable by the network, completely solving the problem of passive leakage of secrets, no longer having status data such as heartbeat packets and synchronization frames passing through the network boundary, and no longer having the possibility of time-based covert channels.

Description

Technical Field

[0001] The present invention relates to the field of optical communication technologies, and particularly to a controllable unidirectional optical transmission device. Background Art

[0002] Traditional optical unidirectional transmission systems generally consist of only three major parts: an optical sending unit, a unidirectional transmission unit, and an optical receiving unit. Among them, the unidirectional transmission unit is composed of an optical sending card and an optical receiving card, and the two are connected by a physical optical fiber to form an optical unidirectional channel.

[0003] To meet the requirement of realizing secure, controllable, and high-speed unidirectional transmission of data across networks, some security enterprises in the industry have proposed using the optical unidirectional method to solve the problem of importing external network data into the internal network, that is, the external network link adopts the unidirectional optical gate technology, combined with automatic security inspection and data tagging technology, to ensure that only the data that has passed the security inspection, with identification and has passed the identification inspection is unidirectionally transmitted to the internal network. This solution solves the problem of automatically and efficiently importing external network data, but its defects are also obvious, mainly manifested in:

[0004] (1) The unidirectional optical gate always maintains a real-time ready transmission channel in one direction and has the ability to transmit network states other than application data, thus easily forming a time-based covert channel.

[0005] (2) One cannot rely on logical control means to block all sensitive or attack-type data before transmission.

[0006] (3) Both the inner and outer ends of the unidirectional optical gate are network reachable, various security policies can be modified or bypassed, and as long as the attacking data sender host is successfully attacked, it is easy to cause the system security to fail. Therefore, this solution has a structural defect.

[0007] (4) The communication ability of the unidirectional optical gate is too strong, and it is easy to become a link carrier for cross-network loop attacks together with the reverse channel (between high-sensitivity networks and low-sensitivity networks). Summary of the Invention

[0008] The present invention provides a controllable unidirectional optical transmission device, which solves the defect that the unidirectional optical gate always maintains a real-time ready transmission channel in one direction and has the ability to transmit network states other than application data, thus easily forming a time-based covert channel. By adopting a new transmission architecture, a security control unit is set between two unidirectional transmission units and is unreachable to both the optical sending unit and the optical receiving unit, becoming an independent and trusted computing unit, ensuring that various security policies implemented on the security control unit can be faithfully executed without being controlled or interfered by the outside, and solving the structural defect that both the sending end and the receiving end of the traditional unidirectional optical gate are network reachable, various security policies can be modified or bypassed, and as long as the attacking data sender host is successfully attacked, it is easy to cause the system security to fail.

[0009] The present invention provides a controllable unidirectional optical transmission device, specifically including:

[0010] A first unidirectional transmission unit, which receives the signal light carrying application data sent by an optical transmission unit.

[0011] A security control unit, which receives the signal light transmitted by the first unidirectional transmission unit, performs data security inspection on the application data carried by the signal light, and continues to send the signal light carrying application data backward when the data security inspection passes.

[0012] A second unidirectional transmission unit, which sends the signal light passing through the security control unit to an optical reception unit.

[0013] The signal light is unidirectionally transmitted in both the first unidirectional transmission unit and the second unidirectional transmission unit.

[0014] According to the controllable unidirectional optical transmission device provided by the present invention, both the first unidirectional transmission unit and the second unidirectional transmission unit include:

[0015] An optical unidirectional transmission card, which collimates the signal light.

[0016] An optical reverse isolator, which receives the signal light after the first collimation process by the optical unidirectional transmission card, transmits the signal light traveling in the forward direction to an optical unidirectional reception card, and isolates the signal light traveling in the reverse direction.

[0017] The optical unidirectional reception card, which focuses the received signal light traveling in the forward direction.

[0018] The signal light traveling in the forward direction is from the optical transmission unit to the optical reception unit, and the signal light traveling in the reverse direction is the signal light with a propagation direction opposite to that of the signal light traveling in the forward direction.

[0019] According to the controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator includes:

[0020] At least one group of polarization rotation optical components, and the polarization rotation optical components include a polarizer and a rotator arranged in sequence on the forward transmission optical path.

[0021] A magnetic ring body, coaxially arranged around the outside of the polarization rotation optical components, and the magnetic field direction of the magnetic ring body is the same as the forward transmission optical path direction.

[0022] An isolation polarizer, located between the last group of polarization rotation optical components and the output end of the optical reverse isolator.

[0023] The polarized light formed after the signal light transmitted in the forward direction passes through each of the polarization rotation components has the same polarization direction as that of the isolation polarizer;

[0024] The signal light transmitted in the reverse direction incident from the isolation polarizer will be orthogonal to the polarization direction of the polarizer of the polarization rotation component after passing through the rotator of each polarization rotation component.

[0025] According to a controllable unidirectional optical transmission device provided by the present invention, the polarization rotation component includes a first polarization rotation component and a second polarization rotation component sequentially arranged on the forward transmission optical path;

[0026] The first polarization rotation component includes a first polarizer and a first rotator. The polarization direction of the first polarizer is perpendicular to the optical path at the input end of the first polarization rotation component, and the first rotator rotates the vertically polarized light passing through the first polarizer to the horizontal direction;

[0027] The second polarization rotation component includes a second polarizer and a second rotator. The polarization direction of the second polarizer is perpendicular to the optical path at the output end of the first polarization rotation component, and the second rotator rotates the horizontally polarized light passing through the second polarizer to be consistent with the polarization direction of the isolation polarizer.

[0028] According to a controllable unidirectional optical transmission device provided by the present invention, the polarization rotation component and the isolation polarizer are both located in the YZ plane. The polarization direction of the first polarizer forms an angle of 90° with the X-axis, the polarization direction of the second polarizer forms an angle of 0° with the X-axis, the polarization direction of the isolation polarizer forms an angle of 45° with the X-axis, the rotation angle of the first rotator is 90° clockwise, and the rotation angle of the second rotator is 45° clockwise.

[0029] According to a controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator further includes:

[0030] An input pigtail, one end of the input pigtail is connected to the fiber input interface of the optical reverse isolator, and the other end of the input pigtail is aligned with the first collimating mirror;

[0031] An output pigtail, one end of the output pigtail is connected to the fiber output interface of the optical reverse isolator, and the other end of the output pigtail is aligned with the second collimating mirror;

[0032] In the forward transmission optical path direction of the signal light, the first collimating mirror is located in front of the first polarizer, and the second collimating mirror is located behind the isolation polarizer.

[0033] According to a controllable unidirectional optical transmission device provided by the present invention, at least one of the optical reverse isolators is a strengthened optical reverse isolator;

[0034] The enhanced optical isolator further includes:

[0035] An aperture, which is disposed on the optical path in the enhanced optical isolator, and the security control unit is communicatively connected thereto through the control interface of the aperture;

[0036] The security control unit controls the opening or closing of the aperture by running a data transmission channel control strategy to control the transmission of the signal light in the enhanced optical isolator.

[0037] According to a controllable unidirectional optical transmission device provided by the present invention, the data transmission channel control strategy includes one or more of a working period control strategy, a manual control strategy, and a batch transmission control strategy.

[0038] According to a controllable unidirectional optical transmission device provided by the present invention, the enhanced optical isolator further includes: a security control lock;

[0039] When the security control lock is in the locked state, the aperture is forced to remain closed;

[0040] When the security control lock is in the unlocked state, the security control unit is enabled to control the opening or closing of the aperture.

[0041] According to a controllable unidirectional optical transmission device provided by the present invention, the optical isolator in the second unidirectional transmission unit is the enhanced optical isolator.

[0042] According to a controllable unidirectional optical transmission device provided by the present invention, the security control unit performs a data security check on the signal light, including a data security check on the application data carried by the signal light.

[0043] According to a controllable unidirectional optical transmission device provided by the present invention, the data security check on the application data carried by the signal light includes:

[0044] One or more of virus and trojan check, data integrity check, data format check, data content check, and data label check.

[0045] The controllable unidirectional optical transmission device provided by the present invention adds a security control unit between the optical transmission unit and the optical reception unit, which is unidirectionally isolated for both the optical transmission unit and the optical reception unit to form a secure and trusted intermediate domain, ensuring the reliability of the security policy, no longer relying on the security of the optically accessible optical transmission unit directly, completely solving the problem of passive information leakage, no longer having status data such as heartbeat packets and synchronization frames penetrating the network boundary, and no longer having the possibility of time-based covert channels. Description of the Drawings

[0046] To more clearly illustrate the technical solutions in the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0047] Figure 1 It is a schematic structural diagram of a unidirectional optical transmission device adopted in the prior art.

[0048] Figure 2 It is one of the schematic structural diagrams of the controllable unidirectional optical transmission device provided by the present invention.

[0049] Figure 3 It is one of the schematic structural diagrams of the unidirectional transmission unit provided by the present invention.

[0050] Figure 4 It is the second schematic structural diagram of the controllable unidirectional optical transmission device provided by the present invention.

[0051] Figure 5 It is one of the schematic structural diagrams of the optical reverse isolator provided by the present invention.

[0052] Figure 6 It is the second schematic structural diagram of the optical reverse isolator provided by the present invention.

[0053] Figure 7 It is the schematic diagram of the optical axis propagation direction provided by the present invention.

[0054] Figure 8 It is the schematic diagram of the forward transmission of the signal light in the optical reverse isolator provided by the present invention.

[0055] Figure 9 It is the schematic diagram of the reverse transmission of the signal light in the optical reverse isolator provided by the present invention.

[0056] Figure 10 It is the third schematic structural diagram of the controllable unidirectional optical transmission device provided by the present invention.

[0057] Figure 11 It is the third schematic structural diagram of the optical reverse isolator provided by the present invention.

[0058] Figure 12 It is the fourth schematic structural diagram of the optical reverse isolator provided by the present invention.

[0059] Figure 13 It is the fifth schematic structural diagram of the optical reverse isolator provided by the present invention.

[0060] Figure 14It is a schematic structural diagram of the security control unit provided by the present invention. Detailed implementation manners

[0061] To make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings in the present invention. Apparently, the described embodiments are some but not all of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in the present invention without any creative efforts shall fall within the protection scope of the present invention.

[0062] It should be noted that in the description of the present invention, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, such that a process, method, article or device including a series of elements not only includes those elements but also includes other elements not explicitly listed, or further includes elements inherent to such process, method, article or device. Without further limitations, an element defined by the statement "including one..." does not exclude the existence of additional identical elements in the process, method, article or device including the element. The orientation or positional relationship indicated by the terms "upper", "lower", "front", "rear", etc. is based on the orientation or positional relationship shown in the drawings, and is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and thus cannot be construed as a limitation on the present invention. Unless otherwise clearly defined and limited, the terms "mounted", "connected" and "coupled" should be understood in a broad sense. For example, it may be a fixed connection, a detachable connection or an integral connection; it may be a mechanical connection, an electrical connection or a communication connection; it may be directly connected or indirectly connected through an intermediate medium, and it may be the internal communication of two elements. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0063] The terms "first", "second", etc. in the present invention are used to distinguish similar objects, rather than to describe a specific order or sequence. It should be understood that such data can be interchanged under appropriate circumstances so that the embodiments of the present invention can be implemented in an order other than those illustrated or described herein, and the objects distinguished by "first", "second", etc. are generally of the same category, and do not limit the number of objects. For example, the first object may be one or more. In addition, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates an "or" relationship between the associated objects before and after.

[0064] Figure 1 is a schematic structural diagram of a unidirectional optical transmission device adopted in the prior art, as Figure 1As shown in the figure, the traditional optical unidirectional transmission system mainly consists of three major parts: an optical transmitting unit (mainly including a light-emitting module), a unidirectional transmission unit, and an optical receiving unit (mainly including a photosensitive module). Among them, the unidirectional transmission unit is mainly composed of an optical transmitting card and an optical receiving card, and the two are connected through a physical optical fiber to form a unidirectional optical fiber channel.

[0065] Generally speaking, there are mainly two deficiencies in the currently widely used unidirectional optical transmission devices:

[0066] Firstly, the traditional optical unidirectional transmission system simply adopts optical fiber isolation devices such as a light-emitting module, a physical optical fiber, and a photosensitive module, and relies on the characteristics that the light-emitting module can only emit light and the photosensitive module can only receive light to achieve the unidirectionality of data transmission. At the same time, based on the fact that the photosensitive module cannot emit light and the light-emitting module cannot receive light, there will be no physical carrier in the reverse direction, so there will be no reverse data leakage. However, this logic faces two problems:

[0067] Problem 1: The above logic depends on the unidirectionality of the information source, that is, the isolation devices are always correctly installed: the light-emitting module is installed in the optical transmitting unit, the photosensitive module is installed in the optical receiving unit, and the light-emitting module can only emit light and the photosensitive module can only sense light. However, the production of optical fiber modules follows international standards. A general optical fiber module, if not specially processed, integrates the capabilities of light emission and photosensitivity. Even if the light-emitting module or the photosensitive module is removed, their appearances and sizes are the same, and due to misoperation during the production process, the light-emitting module and the photosensitive module may be installed in reverse, that is, the light-emitting module may be installed in the optical receiving unit and the photosensitive module may be installed in the optical transmitting unit, resulting in the destruction of the unidirectionality of the information source.

[0068] Problem 2: Once the unidirectionality of the information source is destroyed, the physical optical fiber, as the optical propagation medium, fully supports two-way communication.

[0069] Secondly, to meet the requirement of secure and controllable unidirectional high-speed data transmission across networks, some security enterprises in the industry have proposed using the optical unidirectional method to solve the problem of importing external network data into the internal network, that is, adopting the unidirectional optical gateway technology in the external network link, combined with automatic security inspection and data tagging technology, to ensure that only the data that passes the security inspection, has a label and passes the label inspection is unidirectionally transmitted to the internal network. Although this solution solves the security problem of automatically and efficiently importing external network data, its defects are also obvious, mainly manifested in:

[0070] (1) The unidirectional optical gateway always maintains a real-time ready transmission channel in one direction and has the ability to transmit network states other than application data, thus easily forming a time-based covert channel.

[0071] (2) It cannot block all sensitive or attack-type data before transmission only through logical control means.

[0072] (3) Since both the inner and outer ends of the unidirectional optical gateway are network reachable, various security policies can be modified or bypassed, and as long as the attacking data sender host succeeds, it is easy to cause the security of the entire unidirectional optical transmission system to fail. Therefore, the current solution has structural defects.

[0073] (4) The communication ability of the unidirectional optical gateway is too strong, and it is easy to become a link carrier for cross-network loop attacks together with the reverse channel (between the high-sensitivity network and the low-sensitivity network).

[0074] In view of this, it is urgent to improve the existing unidirectional optical transmission system to provide a more secure and reliable controllable unidirectional optical transmission device to solve these security vulnerabilities in the prior art and prevent data leakage and unauthorized access.

[0075] The following combines Figures 2 - 14 to describe the controllable unidirectional optical transmission device provided by the present invention.

[0076] Figure 2 is one of the structural schematic diagrams of the controllable unidirectional optical transmission device provided by the present invention. As Figure 2 shown, it mainly includes but is not limited to the following components:

[0077] A first unidirectional transmission unit for receiving the signal light carrying application data sent by the optical transmission unit, a security control unit for receiving the signal light transmitted by the first unidirectional transmission unit, performing data security checks on the signal light, and allowing the signal light to pass through in the case of passing the data security checks, and a second unidirectional transmission unit for sending the signal light passing through the security control unit to the optical reception unit.

[0078] Specifically, the controllable unidirectional optical transmission device provided by the present invention mainly realizes the unidirectional transmission and security control of the signal light through a three-level architecture. The core components and the connection relationships of these core components include but are not limited to:

[0079] (1) The first unidirectional transmission unit, whose main function is to serve as the entrance of the signal light transmitter and receive the initial signal light from the optical transmission unit.

[0080] (2) The security control unit, by adding a security control unit as a trusted intermediate domain in the unidirectional optical transmission device, which is independent of the optical transmission unit and the optical reception unit and is used to perform data security checks. For example, performing data security checks on the application data carried by the received signal light, scanning for viruses and Trojans on the application data, and performing application data integrity verification, etc. The security control unit can achieve allowing only the signal light that passes all security checks to enter the next transmission stage.

[0081] The security control unit can be connected to the first unidirectional transmission unit and the second unidirectional transmission unit through an optical fiber interface, and there is no direct network path established between it and the optical transmission unit and the optical reception unit, which can effectively prevent the data security check policy running in the security control unit from being tampered with externally.

[0082] (3) The second unidirectional transmission unit, as the receiving end outlet of the signal light, is used to unidirectionally transmit the signal light that has passed the security check to the optical reception unit.

[0083] The first unidirectional transmission unit and the second unidirectional transmission unit, as unidirectional transmission units (i.e., the signal light is unidirectionally transmitted within the first unidirectional transmission unit and the second unidirectional transmission unit), mainly include an optical unidirectional transmission card, an optical reverse isolator, and an optical unidirectional reception card.

[0084] Among them, the optical unidirectional transmission card is mainly used to collimate the input signal light and convert it into a parallel light beam.

[0085] The optical reverse isolator is designed based on the Faraday magneto-optical crystal effect and Malus' law. It mainly ensures that the signal light can only be transmitted in the forward direction through the combination of a polarization rotation optical component and a magnetic ring body, while the signal light transmitted in the reverse direction is completely isolated.

[0086] The following combines a specific embodiment to elaborate on the specific operation process of the controllable unidirectional optical transmission device provided by the present invention:

[0087] The external network server emits a signal light carrying application data through the optical transmission unit, and the signal light enters the security control unit after being collimated by the first unidirectional transmission unit.

[0088] The security control unit will perform a data security check on the application data carried by the incoming signal light. For example: first, perform a virus scan on the application data to check whether it carries malicious code; then, execute an integrity check on the application data by comparing the data hash value of the application data with the digital signature pre-stored in the optical transmission unit; finally, it can also confirm its public level through the classification and grading label of the application data.

[0089] After the security control unit completes the data security check on the signal light, if it confirms that the result of the data security check is normal, it allows the signal light to pass through and enter the second unidirectional transmission unit.

[0090] On the contrary, if the result of the data security check is abnormal (for example, the signal light carries unauthorized classified data), the security control unit will block the continued transmission of the signal light and generate an alarm log to send to the external network server and / or the internal network server.

[0091] After the signal light is collimated by the second unidirectional transmission unit, it enters the optical receiving unit of the internal network and is finally analyzed and stored by the internal network server.

[0092] By using the controllable unidirectional optical transmission device provided by the present invention, since the security control unit only allows the data passing the inspection to be transmitted, it can effectively cut off the time-based and statistical covert channels. In this way, even if the external network server is invaded, the attacker cannot obtain the data in the internal network server reversely through the security control unit.

[0093] In addition, since the optical reverse isolator adopted is constructed based on the Faraday magneto-optical effect, its reverse isolation degree can reach 70 dB, and the power of the reverse optical signal can be attenuated to one ten-millionth of the original power.

[0094] The controllable unidirectional optical transmission device provided by the present invention adds a security control unit between the optical transmitting unit and the optical receiving unit. For the optical transmitting unit and the optical receiving unit, it is unidirectionally isolated to form a secure and trusted intermediate domain, ensuring the reliability of the security policy. It no longer depends on the security of the optical transmitting unit with direct network access, completely solves the problem of passive information leakage, there are no longer status data such as heartbeat packets and synchronization frames passing through the network boundary, and there is no longer the possibility of time-based covert channels.

[0095] Based on the content of the above embodiments, as an alternative embodiment, both the first unidirectional transmission unit and the second unidirectional transmission unit include:

[0096] An optical unidirectional transmitting card for collimating the signal light;

[0097] An optical reverse isolator for receiving the signal light after the first collimation process by the optical unidirectional transmitting card, transmitting the forward-transmitted signal light therein to the optical unidirectional receiving card, but isolating the reverse-transmitted signal light therein;

[0098] An optical unidirectional receiving card mainly for focusing the received forward-transmitted signal light.

[0099] Among them, the forward-transmitted signal light refers to the direction from the optical transmitting unit to the optical receiving unit, and the reverse-transmitted signal light is the signal light with the propagation direction opposite to that of the forward-transmitted signal light.

[0100] Figure 3 is one of the structural schematic diagrams of the unidirectional transmission unit provided by the present invention. As Figure 3 shown, as the unidirectional transmission unit, the internal structure of the first unidirectional transmission unit and the second unidirectional transmission unit is mainly composed of three components: an optical unidirectional transmitting card, an optical reverse isolator, and an optical unidirectional receiving card.

[0101] The optical unidirectional transmission card serves as the emitter shaper for the signal light, including a collimating lens or a collimating lens group (such as an aspherical lens or an optical fiber collimator). By receiving the signal light from the optical transmission unit (the signal light at this time is generally a divergent beam), it uses the collimating lens or the collimating lens group to convert the divergent signal light into a parallel beam, reducing the transmission loss while making the beam entering the optical reverse isolator controllable.

[0102] The function of the optical reverse isolator in the entire unidirectional transmission unit is to achieve forward transmission and complete reverse isolation of the signal light, that is, to transmit the forward-transmitted signal light to the optical unidirectional receiving card and isolate the signal light that may be transmitted in the reverse direction. The input end of the optical reverse isolator is docked with the optical unidirectional transmission card through an optical fiber, and the output end of the optical reverse isolator is docked with the optical unidirectional receiving card through an optical fiber.

[0103] Optionally, the optical reverse isolator mainly screens the signal light of a specific polarization direction through a polarizer combination, and then uses a rotatory optical material (such as terbium-doped glass) to change the polarization direction of the light. After the forward-transmitted signal light is screened by the polarizer, only the component of a specific polarization direction is retained. The rotatory optical material rotates the polarization direction by a preset angle (such as 90° or 45°). After multi-stage regulation, the polarization direction of the signal light matches the polarizer at the output end, and the signal light can pass through.

[0104] Correspondingly, the reverse-transmitted signal light (such as the signal light entering through the output end of the optical reverse isolator), after being adjusted by the polarizer combination, makes the propagation direction of the signal light orthogonal to the polarizer near the input end of the optical reverse isolator. In this way, the reverse-transmitted signal light is completely isolated due to polarization mismatch and cannot enter the optical unidirectional transmission card.

[0105] The optical unidirectional receiving card is located at the output end of the unidirectional transmission unit. Its input end is coupled with the output end of the optical reverse isolator, and the output end is connected to the optical receiving unit through an optical fiber. The optical unidirectional receiving card mainly includes a group of focusing lenses (such as a gradient index lens or a self-focusing lens) for focusing the signal light output by the optical reverse isolator. After receiving the collimated beam output by the optical reverse isolator, it focuses the parallel collimated beam into a point light source to adapt to the photodetector at the receiving end, etc.

[0106] The optical unidirectional receiving card can compensate for the spot divergence effect in optical fiber transmission, ensure the stability of the optical power at the receiving end, and reduce the risk of signal-to-noise ratio degradation caused by mismatched spot sizes.

[0107] Figure 4 It is the second structural schematic diagram of the controllable unidirectional optical transmission device provided by the present invention, as Figure 4As shown in the figure, the controllable unidirectional optical transmission device of this embodiment adopts a three-stage cascaded architecture. On the optical path of the signal light transmitted in the forward direction, a first unidirectional transmission unit, a security control unit, and a second unidirectional transmission unit are sequentially arranged. Among them, the input end of the first unidirectional transmission unit is fiber-connected to the optical transmission unit, and the output end of the first unidirectional transmission unit is connected to the security control unit; the input end of the second unidirectional transmission unit is connected to the security control unit, and its output end is fiber-connected to the optical reception unit.

[0108] The operation process of the above controllable unidirectional optical transmission device can be as follows:

[0109] 1) External devices (such as servers, terminal devices) convert electrical signals into signal light through the optical transmission unit and transmit it to the optical unidirectional transmission card of the first unidirectional transmission unit through optical fibers.

[0110] 2) The optical unidirectional transmission card collimates the incoming divergent signal light and outputs a parallel light beam to the optical reverse isolator.

[0111] 3) The optical reverse isolator filters out the signal light transmitted in the forward direction in the parallel light beam and blocks the signal light that may be transmitted in the reverse direction.

[0112] 4) The signal light transmitted in the forward direction passing through the optical reverse isolator enters the security control unit to perform data security checks.

[0113] 5) If the security check passes, the passed signal light is collimated by the optical unidirectional transmission card of the second unidirectional transmission unit and further isolated from the signal light that may be transmitted in the reverse direction through the optical reverse isolator, and finally focused and sent to the optical reception unit by the optical unidirectional reception card of the second unidirectional transmission unit.

[0114] Based on the above operation process, it can be found that any optical signal attempting to be transmitted in the reverse direction from the receiving end (such as the optical reception unit) will be physically intercepted by the optical reverse isolators in the second unidirectional transmission unit and the first unidirectional transmission unit, and the transmittance approaches zero, effectively achieving physical layer isolation. In addition, the reverse-transmitted optical signal will also undergo logical isolation by the security control unit, and the security control unit is independently deployed to prevent the relevant device strategies running in the security control unit from being bypassed by the optical transmission unit / optical reception unit.

[0115] The controllable unidirectional optical transmission device provided by the present invention utilizes the optical device characteristics of the unidirectional transmission unit to make up for the security risks caused by possible protocol loopholes or configuration errors in the security control unit. At the same time, by setting the first unidirectional transmission unit and the second unidirectional transmission unit on both sides of the security control unit at the same time, even if a certain unidirectional transmission unit fails, the optical reverse isolator in the other unidirectional transmission unit can still block the signal light transmitted in the reverse direction.

[0116] It should be noted that in the controllable unidirectional optical transmission device provided by the present invention, the optical reverse isolator adopted can be designed based on the Faraday magneto-optical crystal effect and Malus' law.

[0117] Among them, the Faraday magneto-optical crystal effect describes that when linearly polarized light propagates in a medium and a strong magnetic field is applied parallel to its propagation direction, the vibration direction thereof will deflect. The deflection angle θ is proportional to the product of the Verdet constant V of the optical rotator, the magnetic induction intensity B, and the medium length L, that is: θ = VBL.

[0118] Malus' law describes that after linearly polarized light passes through a polarizer, the intensity of the transmitted light I = I 0 cos 2 θ. Where θ is the angle between the optical vibration direction of the incident linearly polarized light and the polarization direction of the polarizer, and I 0 is the intensity of the incident linearly polarized light.

[0119] Figure 5 is one of the structural schematic diagrams of the optical reverse isolator provided by the present invention. The following provides a specific structure of a controllable unidirectional optical transmission device in conjunction with Figure 5 as shown. The controllable unidirectional optical transmission device includes a first unidirectional transmission unit, a safety control unit, and a second unidirectional transmission unit. Both the first unidirectional transmission unit and the second unidirectional transmission unit include an optical unidirectional sending card, an optical reverse isolator, and the optical unidirectional receiving card.

[0120] Optionally, as an optical reverse isolator provided in this embodiment, it mainly includes, but is not limited to: at least one set of polarization rotation components, and the polarization rotation components include a polarizer and an optical rotator sequentially arranged on the forward transmission optical path; a magnetic ring body coaxially arranged around the outside of the polarization rotation components, and the magnetic field direction of the magnetic ring body is the same as the forward transmission optical path direction; an isolation polarizer located between the last set of polarization rotation components and the output end of the optical reverse isolator.

[0121] The polarized light formed after the signal light in the forward transmission passes through each polarization rotation component has the same polarization direction as the isolation polarizer. The signal light in the reverse transmission incident from the isolation polarizer will be orthogonal to the polarization direction of the polarizer of the polarization rotation component after passing through the optical rotator of each polarization rotation component.

[0122] The optical reverse isolator realizes the unidirectional transmission and complete reverse isolation of the signal light through the cooperation of the polarization rotation components, the magnetic ring body, and the isolation polarizer. Its structure and working principle are as follows:

[0123] The polarization rotation component includes a polarizer and a rotator. The polarizer is used to screen optical signals with a specific polarization direction (such as vertical polarization). The rotator is made of a crystal material that changes the polarization direction of light based on the Faraday magneto-optical effect. At least one polarizer and at least one rotator form a polarization rotation component.

[0124] Optionally, the polarization rotation component in an optical reverse isolator can be a set, or multiple sets of polarization rotation components can be arranged in series on the optical path to adjust the input light to an angle matching the isolation polarizer at the output end by gradually rotating the polarization direction. At the same time, the polarization direction of the signal light transmitted in the reverse direction is made orthogonal to the polarizer near the input end by reverse rotation to achieve physical isolation.

[0125] The magnetic ring body is a structure that surrounds the polarization rotation component and can provide a constant magnetic field for the polarization rotation component. The intensity of the constant magnetic field can be set according to actual polarization rotation requirements, generally in the range of 0.5T to 1.0T. The magnetic field direction of the constant magnetic field is generally strictly consistent with the optical path direction of the signal light transmitted in the forward direction in the optical reverse isolator to ensure the stability of the optical rotation effect of the rotator.

[0126] The purpose of the magnetic ring body to provide a constant magnetic field is to activate the Faraday magneto-optical effect and make the rotation angle of the rotator for light polarization meet the requirements. For example, the rotation angle of the rotator for light polarization can be adjusted by adjusting the magnetic ring parameters (such as magnetic field intensity, length) of the magnetic ring body to optimize the isolation performance of the optical reverse isolator.

[0127] The isolation polarizer can be a high extinction ratio polarizer. For example, if quartz material is selected, its extinction ratio can be greater than 10 6 :1. The polarization direction of the isolation polarizer is generally fixed. For example, an isolation polarizer with a polarization direction at an angle of 45° with the X-axis is selected, which allows signal light at 45° obliquely to pass through. When using it to isolate the signal light transmitted in the reverse direction, the optical path direction of the signal light transmitted in the reverse direction can be adjusted to be orthogonal to the polarization direction of the isolation polarizer through the polarization rotation component, and then its transmittance approaches zero.

[0128] As another alternative embodiment, as Figure 6 shown, in the controllable unidirectional optical transmission device provided by the present invention, it mainly includes a magnetic ring body arranged outside the polarization rotation component, an isolation polarizer near the output end of the optical reverse isolator, and a polarization rotation component.

[0129] Two sets of polarization rotation components are arranged in each optical reverse isolator, specifically including a first polarization rotation component and a second polarization rotation component sequentially arranged on the forward transmission optical path.

[0130] Among them, the first polarization rotation optical component includes a first polarizer and a first optical rotator. The polarization direction of the first polarizer is perpendicular to the optical path at the input end of the first polarization rotation optical component, and the first optical rotator rotates the vertically polarized light passing through the first polarizer to the horizontal direction.

[0131] The second polarization rotation optical component includes a second polarizer and a second optical rotator. The polarization direction of the second polarizer is perpendicular to the optical path at the output end of the first polarization rotation optical component, and the second optical rotator rotates the horizontally polarized light passing through the second polarizer to be consistent with the polarization direction of the isolation polarizer.

[0132] In this embodiment, the first polarizer in the first polarization rotation optical component is perpendicular to the optical path at the input end, which is used to filter out vertically polarized light and suppress horizontally polarized light noise. The first optical rotator is used to rotate the filtered vertically polarized light clockwise by 90° to the horizontal direction.

[0133] The second polarizer in the second polarization rotation optical component is perpendicular to the optical path at the output end of the previous stage (the first polarization rotation optical component), further filtering out horizontally polarized light and suppressing vertically polarized light noise. The second optical rotator is used to rotate the horizontally polarized light clockwise by 45° to be 45° obliquely polarized light to match the isolation polarizer.

[0134] Since the isolation polarizer is set to have a polarization direction of 45° obliquely, it allows 45° obliquely polarized light to pass through, but will completely reflect or absorb the signal light in other polarization directions.

[0135] Figure 7 It is a schematic diagram of the optical axis propagation direction provided by the present invention. As an alternative embodiment, as Figure 7 shown, assuming that the light propagation direction is along the X-axis direction, it is set that the polarization rotation optical component and the isolation polarizer are both located in the YZ plane. The angle between the polarization direction of the first polarizer and the X-axis is 90°, the angle between the polarization direction of the second polarizer and the X-axis is 0°, the angle between the polarization direction of the isolation polarizer and the X-axis is 45°, the optical rotation angle of the first optical rotator is clockwise rotation of 90°, and the optical rotation angle of the second optical rotator is clockwise rotation of 45°.

[0136] Figure 8 It is a schematic diagram of the forward transmission of the signal light in the optical reverse isolator provided by the present invention. As Figure 8 shown, when the signal light perpendicular to the YZ plane (generally including vertical and horizontal components) passes through the first polarizer, since the polarization direction of the first polarizer is the vertical direction (the angle with the X-axis is 90°), the angle between the polarization direction of the signal light transmitted through the first polarizer and the Y-axis is θ = 0.

[0137] Further, after this signal light passes through the first optical rotator, the first optical rotator rotates the polarization direction of the polarized light clockwise by 90°, parallel to the Z-axis (θ = 90°). At this time, the optical axis direction of the signal light coincides with the polarization direction of the second polarizer and will transmit through the second polarizer and enter the second optical rotator.

[0138] When the signal light passes through the second optical rotator, the polarization direction of the polarized light continues to rotate clockwise by 45°, becoming a signal light at a 45° angle to the Y-axis. At this time, the optical axis direction of the signal light exactly coincides with the polarization direction of the isolation polarizer near the output end (optical reverse isolator), and it will also transmit through the isolation polarizer. Finally, the signal light will enter the optical unidirectional receiving card for focusing and then output.

[0139] Figure 9 It is a schematic diagram of the reverse transmission of the signal light in the optical reverse isolator provided by the present invention. As Figure 9 shown, when the signal light perpendicular to the YZ plane is the signal light in the forward transmission direction, it will enter from the isolation polarizer. Since the polarization direction of the isolation polarizer is at a 45° angle to the Y-axis, the polarization direction of the signal light transmitted through the isolation polarizer becomes at a 45° angle to the Y-axis.

[0140] Further, this signal light will pass through the second optical rotator, and the second optical rotator will rotate it clockwise by 45°. At this time, the polarization direction of the signal light passing through the second optical rotator forms an angle of 0 with the Y-axis (θ = 0°), and exactly orthogonally to the polarization direction of the second polarizer. According to Malus' law, the intensity of the signal light transmitted through the second polarizer theoretically becomes 0. Assuming there are some errors in the actual process, a small part of the signal light passes through the second polarizer.

[0141] To further enhance the optical reverse isolation degree, this small part of the signal light transmitted through the second polarizer will pass through the first optical rotator, and the first optical rotator rotates it clockwise by 45°. The polarization direction of the obtained signal light is parallel to the Z-axis (θ = 90°), so it exactly orthogonally to the polarization direction of the first polarizer. The intensity of the transmitted signal light theoretically becomes 0 at this time, further suppressing the propagation of the signal light in the reverse transmission.

[0142] The controllable unidirectional optical transmission device provided by the present invention not only uses an optical fiber channel with a reverse isolator to solve the problem that once the unidirectionality of the light source is destroyed in a traditional optical shutter, the optical fiber cable, as an optical propagation medium, fully supports bidirectional communication. At the same time, on the basis of using two-stage series-connected optical unidirectional transmission units, at least two groups of polarization rotation components are configured for the optical reverse isolator in each optical unidirectional transmission unit, fundamentally solving the problem that the logic of the traditional optical shutter depends on the unidirectionality of the light source, resulting in the destruction of the unidirectionality of the light source caused by the possible incorrect installation of the light-emitting module and the photosensitive module during the production process due to misoperation, and truncating the reverse optical transmission channel to the greatest extent, enhancing the credibility and controllability of the unidirectional transmission channel.

[0143] Combined with Figure 5 or Figure 6 As shown, in the controllable unidirectional optical transmission device provided by the present invention, in addition to the polarization rotation components, magnetic ring bodies, isolation polarizing plates and other components introduced in the above embodiments, the optical reverse isolator further includes:

[0144] An input pigtail, one end of the input pigtail is connected to the optical fiber input interface of the optical reverse isolator, and the other end of the input pigtail is aligned with the first collimating mirror;

[0145] An output pigtail, one end of the output pigtail is connected to the optical fiber output interface of the optical reverse isolator, and the other end of the output pigtail is aligned with the second collimating mirror;

[0146] In the optical path direction of the forward transmission of the signal light, the first collimating mirror is located in front of the first polarizing plate, and the second collimating mirror is located behind the isolation polarizing plate.

[0147] Specifically, the present invention provides a double-pigtail collimating mirror coupling structure to achieve efficient transmission and precise optical path alignment of optical signals in the isolator, and at the same time solve the problem of insertion loss fluctuation caused by the inclination of the optical fiber end face in the traditional isolator.

[0148] Among them, the input pigtail can adopt an LC / UPC optical fiber connector, and its end face can adopt a chemical-mechanical polishing (CMP) process to reduce the surface roughness. The output pigtail is compatible with the input pigtail, and both can support hot pluggable operation.

[0149] The first collimating mirror and the second collimating mirror generally adopt aspherical lenses. The first collimating mirror is installed in front of the first polarizing plate (along the optical path direction of forward propagation) to collimate the divergent light beam output from the pigtail into a parallel light beam, reducing the surface reflection loss of the polarizing plate. The second collimating mirror is installed within a certain distance range behind the isolation polarizing plate to calibrate the oblique signal light transmitted through the isolation polarizing plate and output it parallel to the receiving-end optical fiber.

[0150] To further address the potential risks of reverse optical signal injection attacks or optical path misoperations in optical communication systems, the present invention provides an enhanced optical reverse isolator based on aperture regulation. By integrating an electronically controlled aperture and a safety control unit, real-time safety management of the optical path is achieved, ensuring that the signal light is transmitted only under authorized conditions, while also supporting remote fault diagnosis and emergency fusing functions.

[0151] The controllable unidirectional optical transmission device provided by the present invention mainly includes core components such as a first unidirectional transmission unit, a safety control unit, and a second unidirectional transmission unit. Both the first unidirectional transmission unit and the second unidirectional transmission unit are composed of an optical unidirectional transmission card, an optical reverse isolator, and an optical unidirectional reception card. The optical reverse isolator in at least one of the first unidirectional transmission unit and the second unidirectional transmission unit can be upgraded to an enhanced optical reverse isolator with aperture regulation.

[0152] Figure 10 is the third schematic diagram of the structure of the controllable unidirectional optical transmission device provided by the present invention, as Figure 10 shown, it is by upgrading the optical reverse isolator in the second unidirectional transmission unit to an enhanced optical reverse isolator.

[0153] After upgrading to an enhanced optical reverse isolator, the safety control unit controls the opening and closing of the aperture through the safety controller according to the data transmission channel control strategy, and conducts physical on-off control of the data transmission channel. For example, by only maintaining a ready data transmission channel during working hours, cross-network loop attacks can be effectively blocked, the state transfer and response capabilities at the link level are truncated, and only the data-controlled secure transmission capability is retained.

[0154] In addition, the optical reverse isolator in the first unidirectional transmission unit can also be upgraded to an enhanced optical reverse isolator, or the optical reverse isolators in both the first unidirectional transmission unit and the second unidirectional transmission unit can be upgraded to enhanced optical reverse isolators simultaneously.

[0155] Figure 11 is the third schematic diagram of the structure of the optical reverse isolator provided by the present invention, which shows an ordinary optical reverse isolator. Figure 12 is the fourth schematic diagram of the structure of the optical reverse isolator provided by the present invention, which shows an enhanced optical reverse isolator with additional supporting structures such as an aperture.

[0156] As Figure 12 shown, the enhanced optical reverse isolator mainly includes components such as an input end, an isolation layer, an aperture, a control interface, and an output end. Its implementation method for optical reverse suppression transmission is the same as that of an ordinary optical reverse isolator, except that an aperture and a control interface are added. By controlling the opening and closing of the aperture through the safety control unit, physical on-off control of the transmission channel of the signal light is achieved, thus having the ability to conduct physical on-off control of the transmission channel.

[0157] The aperture in the present invention adopts a fully closable aperture. When the aperture blades are in the closed state, they can completely block the central area of the aperture blades to achieve the effect of full light closure. Specifically, it can be composed of a metal alloy frame wrapped with a liquid crystal dimming film and has an axially symmetric design. For the selection of the aperture size (including inner diameter, outer diameter, thickness, etc.), it is mainly based on the size of the fiber bundle adapting to the signal light. For example, when the core diameter is 6 μm, the selectable aperture size is: inner diameter Φ2 mm, outer diameter Φ5 mm, and thickness 1 mm.

[0158] In the actual optical path, the aperture is arranged between the isolation polarizer and the second collimator, and the aperture can be fixed in the housing of the optical reverse isolator through a micro spring clamping ring and supports ±0.1 mm axial displacement compensation.

[0159] The hardware of the security control unit mainly includes components such as an independent CPU, an operating system, a hard disk, an input / output interface, etc. Its software function mainly realizes receiving and sending data of the unidirectional receiving and sending unit and performing data security checks on it according to security policies, including security checks on virus trojans, data integrity, data format, data content, data tags, etc. The data that passes the check is unidirectionally sent to the optical receiving unit through the second optical unidirectional transmission unit. At the same time, this unit also has functions such as system management, log recording, behavior auditing, data transmission channel control strategy, and data security check strategy configuration.

[0160] The security control unit can generally be installed outside the housing of the optical reverse isolator and is docked with the aperture control interface through an optical fiber interface.

[0161] As Figure 12 shown, when the aperture is in the normal open state, the light-transmitting area of the aperture is aligned with the optical path axis.

[0162] Figure 13 is the fifth schematic diagram of the structure of the optical reverse isolator provided by the present invention. As Figure 13 shown, when the aperture is in the closed state, the baffle of the aperture will completely block the optical path and the light spot will be truncated. The controllable unidirectional optical transmission device provided by the present invention can achieve microsecond-level response by regulating the optical path through the aperture, with a speed increase of 3 orders of magnitude compared to traditional mechanical switches.

[0163] In the controllable unidirectional optical transmission device provided by the present invention, the security control unit can control the opening and closing of the aperture through the security controller according to the data transmission channel control strategy, physically connect and disconnect the data transmission channel, and only maintain the ready data transmission channel during the working period, solving the problem that the unidirectional optical gateway is prone to become a link carrier for cross-network loop attacks. Innovatively, a unidirectional transmission channel with physical connection and disconnection control ability is adopted, solving the defect that the unidirectional optical gateway always maintains a real-time ready transmission channel in one direction and has the ability to transmit network status other than application data, which is prone to form a time-based covert channel.

[0164] Figure 14 It is a schematic structural diagram of the security control unit provided by the present invention. As Figure 14 shown, the device policies run by the security control unit provided by the present invention mainly include data security inspection policies and data transmission channel control policies. Among them, the data transmission channel control policies mainly include working period control policies, manual control policies, batch transmission control policies, etc.

[0165] Among them, the working period control policy refers to controlling the opening and closing state of the aperture according to the preset time window (such as the non-working period mode from 00:00 to 06:00) policy, realizing the connection and disconnection of the data transmission channel at the physical level, so as to ensure the security of the transmission channel.

[0166] The manual control policy refers to the policy that auditors or managers can control the transmission tasks and the opening and closing state of the aperture through the Web interface. It should be noted that the manual control policy can adopt hierarchical permission management. For example, all auditors or managers are divided into multiple levels such as system administrators, auditors, department heads, and ordinary users, and different manual control permissions are set between different levels.

[0167] The batch transmission control policy refers to opening the transmission channel for batch data transmission for data files in a specific format (such as xml files and json files in a fixed format) under specific conditions.

[0168] Take Figure 10 the controllable unidirectional optical transmission device shown as an example. According to the data transmission channel control policy preset for the security control unit, the physical connection and disconnection control of the transmission channel is realized by controlling the opening or closing of the aperture of the second unidirectional transmission unit (located between the security control unit and the optical receiving unit).

[0169] For example, if the working period control strategy is set to the daily working hours (e.g., 09:00~20:00), within this working period, the security control unit will control the aperture to open, turn on the transmission channel, and prevent illegal data transmission without supervision. The manual control strategy can be set such that the application data carried by the optical signal requires manual review. After the manual review is passed, the aperture will be manually opened by the operator to ensure the controlled transmission of data. The batch transmission control strategy can be set such that data files in a specific format will open the transmission channel and perform batch transmission under specific conditions.

[0170] The security control unit is also responsible for performing data security checks on the signal light, including data security checks on the application data carried by the signal light, mainly including: virus and Trojan inspection, data integrity check, data format check, data content check, and data label check, etc.

[0171] For virus and Trojan inspection, the virus library (such as the ClamAV virus library, which supports the CVE vulnerability signature library) can be integrated into the security control unit to detect the application data and match the virus signature codes. Alternatively, the application data can be downloaded to the local sandbox (ARM Cortex-A72 processor) to perform virtual operation and monitor API call behaviors. When it is detected that the application data contains high-risk virus characteristics, the transmission of the optical signal can be blocked in real time by controlling the aperture to close, triggering a fuse alarm.

[0172] For data integrity check, the security control unit can calculate the hash value of the application data carried by the optical signal and compare the calculation result with the hash value carried in its task to prevent the application data from being tampered with.

[0173] For data format check, it can include in-depth format checks by parsing the file format suffix name and the actual format of the application data.

[0174] For data content check, it can detect whether the application data contains abnormal content such as sensitive words through keyword scanning, semantic analysis, etc.

[0175] For data label check, the signature identity and permissions of the application data transmitted by the optical signal can be determined through digital signature verification or source data verification.

[0176] In summary, the controllable unidirectional optical transmission device provided by the present invention can perform data security checks on the signal light through the security control unit, so as to perform network protocol parsing and application layer data stripping on all transmitted application data according to the data security check results, and perform virus and Trojan inspection and data integrity verification, achieving the purpose of blocking all sensitive or attack-type data before transmission.

[0177] As an alternative embodiment, the present invention also configures a safety control lock for each enhanced optical isolator. When the safety control lock is in the locked state, the aperture is forced to remain closed; when the safety control lock is in the unlocked state, the safety control unit is enabled to control the opening or closing of the aperture.

[0178] The safety control lock is a prerequisite for opening the aperture. If the safety control lock is opened, the aperture can be opened by the safety control unit. If the safety control lock is locked, the safety control unit cannot open the aperture, which physically controls the channel manually and further enhances the reliability and controllability of the unidirectional transmission channel.

[0179] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art can understand and implement it without creative labor.

[0180] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0181] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of each embodiment of the present invention.

Claims

1. A controllable unidirectional optical transmission device, characterized in that: include: a first unidirectional transmission unit, which receives the signal light carrying the application data sent by the optical sending unit; a security control unit, which receives the signal light transmitted by the first unidirectional transmission unit, performs a data security check on the signal light, and allows the signal light to pass if the data security check passes; a second unidirectional transmission unit, which transmits the signal light passing through the safety control unit to a light receiving unit; The signal light is unidirectionally transmitted in both the first unidirectional transmission unit and the second unidirectional transmission unit.

2. The controllable unidirectional optical transmission device according to claim 1, characterized in that: The first unidirectional transmission unit and the second unidirectional transmission unit both include: An optical unidirectional transmission card for collimating the signal light; An optical reverse isolator receives the signal light after the first collimation processing of the optical unidirectional sending card, transmits the signal light transmitted in the forward direction to the optical unidirectional receiving card, and isolates the signal light transmitted in the reverse direction; The optical unidirectional receiving card focuses the received signal light transmitted in the forward direction; The forward-transmitted signal light is a direction from the optical transmitting unit to the optical receiving unit, and the reverse-transmitted signal light is a signal light that is opposite to the propagation direction of the forward-transmitted signal light.

3. The controllable unidirectional optical transmission device according to claim 2, characterized in that: The optical reverse isolator comprises: At least one set of polarization rotator components, wherein the polarization rotator components include a polarizer and an optical rotator arranged in sequence on a forward transmission optical path; A magnetic ring body, coaxially arranged outside the polarization rotator component, and the magnetic field direction of the magnetic ring body is the same as the direction of the forward transmission light path; An isolation polarizer, located between the last set of polarization rotator components and the output end of the optical reversal isolator; The polarized light formed by the forward-transmitted signal light after passing through each of the polarization rotator components has the same polarization direction as the isolation polarizer; The reversely transmitted signal light incident from the isolation polarizer will be orthogonal to the polarization direction of the polarizer of the polarization rotator assembly after passing through the rotator of each polarization rotator assembly.

4. The controllable unidirectional optical transmission device according to claim 3, characterized in that: The polarization rotator assembly comprises a first polarization rotator assembly and a second polarization rotator assembly which are sequentially arranged on the optical path of forward transmission; The first polarization rotator assembly includes a first polarizer and a first optical rotator, wherein the polarization direction of the first polarizer is perpendicular to the optical path of the input end of the first polarization rotator assembly, and the first optical rotator rotates the vertically polarized light passing through the first polarizer to a horizontal direction; The second polarization rotator assembly includes a second polarizer and a second rotator, the polarization direction of the second polarizer is perpendicular to the output end optical path of the first polarization rotator assembly, and the second rotator rotates the horizontally polarized light passing through the second polarizer to be consistent with the polarization direction of the isolation polarizer.

5. The controllable unidirectional optical transmission device according to claim 4, characterized in that: The polarization rotator assembly and the isolation polarizer are both located in the YZ plane, the angle between the polarization direction of the first polarizer and the X-axis is 90°, the angle between the polarization direction of the second polarizer and the X-axis is 0°, the angle between the polarization direction of the isolation polarizer and the X-axis is 45°, the optical rotation angle of the first optical rotator is 90° clockwise, and the optical rotation angle of the second optical rotator is 45° clockwise.

6. The controllable unidirectional optical transmission device according to claim 4, characterized in that: The optical reverse isolator further comprises: An input pigtail, one end of which is connected to the optical fiber input interface of the optical reverse isolator, and the other end of which is aligned with the first collimator; An output pigtail, one end of which is connected to the optical fiber output interface of the optical reverse isolator, and the other end of which is aligned with the second collimator; In the optical path direction of the forward transmission of the signal light, the first collimator is located in front of the first polarizer, and the second collimator is located behind the isolation polarizer.

7. The controllable unidirectional optical transmission device according to any one of claims 2 to 6, characterized in that: At least one of the optical reverse isolators is an enhanced optical reverse isolator; The enhanced optical reverse isolator further comprises: An aperture, the aperture being arranged on the optical path of the enhanced optical reverse isolator, and the safety control unit being communicatively connected with the aperture through a control interface of the aperture; The safety control unit decides the opening or closing of the aperture by running a data transmission channel control strategy, so as to control the transmission of the signal light in the enhanced optical reverse isolator.

8. The controllable unidirectional optical transmission device according to claim 7, characterized in that: The data transmission channel control strategy includes one or more of a working period control strategy, a manual control strategy and a batch transmission control strategy.

9. The controllable unidirectional optical transmission device according to claim 7, characterized in that: The enhanced optical reverse isolator further includes: a safety control lock; When the safety control lock is in a locked state, the aperture is forced to remain closed; When the safety control lock is in an unlocked state, the safety control unit is enabled to control the opening or closing of the aperture.

10. The controllable unidirectional optical transmission device according to claim 7, characterized in that: The optical reverse isolator in the second unidirectional transmission unit is the enhanced optical reverse isolator.

11. The controllable unidirectional optical transmission device according to claim 1, characterized in that: The security control unit performs a data security check on the signal light, including a data security check on the application data carried by the signal light.

12. The controllable unidirectional optical transmission device according to claim 11, characterized in that: The data security check on the application data carried by the signal light includes: One or more of virus and Trojan horse check, data integrity check, data format check, data content check and data label check.

Images