Secure sharing exchange method and system based on double unidirectional optical shutters

Abstract

The invention discloses a secure sharing exchange method and system based on double unidirectional optical shutters. The method comprises the following steps: respectively deploying a sharing exchange service in two networks isolated by optical gates, and registering interface information of business applications needing cross-optical-gate interaction on the sharing exchange services; each network comprises a database which is used for storing registration information, a transmission record, a transmitted application name, a transmission state, transmission time, transmission content and a return result; through an application registration step and a unique interface name of the whole domain, on the basis of not leaking an IP and a port to different security network domains, service application cross-optical-shutter file transmission and HTTP parameter request are realized based on a TCP / IP protocol, and the invasiveness to a service application code is reduced; according to the invention, monitoring of data transmission is realized in a transmission process; and after the transmission is completed, the receiving side returns the transmitted application name, the transmission parameter or the file name and the sending time to the transmission initiating side to form a transmission closed loop.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security and relates to a secure sharing and exchange method and system based on a dual unidirectional optical switch. Background Art

[0002] With the development of information technology, network security has become increasingly important in production. In addition to common security reinforcements against SQL injection, XSS attacks, CSRF attacks, etc., isolating important classified data environments from ordinary data environments through network security isolation optical switches has gradually become a common technical means to protect important data. The optical switch realizes the unidirectional transmission of data between different networks (two completely isolated networks or internal and external networks) through a fiber channel, and is physically disconnected in the reverse direction to ensure the security of the isolated network and the confidentiality of information. The optical switch uses a high-performance chip to enhance the data ferry ability and performs data exchange through proprietary component devices, security protocols, and encryption verification mechanisms, completely blocking the direct TCP / IP connection between networks.

[0003] On the other hand, in the process of transmitting confidential information in some state organs, it is impossible to use the IP mapping method to unidirectionally transmit data from a low-security domain to a high-security domain, that is, the low-security domain application cannot directly call the IP port of the high-security domain application for data interaction. Therefore, a data exchange intermediate platform is required to achieve secure data exchange without leaking the IP port to the business applications in the low-security domain.

[0004] Currently, the existing cross-optical switch data transmission methods have the following disadvantages:

[0005] 1. Most of the existing solutions use the file ferry method for cross-optical switch data transfer, which requires implementing a call method in the business application code and has a high invasiveness to the application code;

[0006] 2. The existing cross-optical switch web request proxy method cannot protect the IP and port information of different especially high-security domains from being leaked during the communication process. Summary of the Invention

[0007] Aiming at the problems existing in the prior art, the purpose of the present invention is to provide a secure sharing and exchange method and system based on a dual unidirectional optical switch.

[0008] The present invention realizes the file transfer and HTTP parameter request of business applications across the optical switch based on the TCP / IP protocol without leaking the IP and port to different security network domains through the application registration step and a globally unique interface name, reducing the invasiveness to the business application code.

[0009] During the transmission process, the present invention records the application name, the content transmitted, the transmission time, and the reception time to realize the monitoring of data transmission.

[0010] After the transmission is completed, after receiving on the receiving side and sending to Service Application B, the application name, transmission parameters or file name, and sending time of the transmission are used to generate a JSON file and sent back to the transmission initiating side to sense the data transmission efficiency and form a transmission closed loop.

[0011] The technical solution of the present invention is as follows:

[0012] A secure sharing and exchange method based on a dual unidirectional optical switch, the steps of which include:

[0013] 1) A sharing and exchange service is respectively deployed in two networks isolated by an optical switch, and the interface information of service applications that need to interact across the optical switch is registered on the sharing and exchange service; each of the networks includes a database for storing registration information, transmission records, transmitted application names, transmission status, transmission time, transmission content, and return results; the two networks are respectively denoted as Network A and Network B, the sharing and exchange service deployed in Network A domain is denoted as Secure Sharing and Exchange Service A, and the sharing and exchange service deployed in Network B domain is denoted as Secure Sharing and Exchange Service B; Network A sends data to Network B through the first optical switch, and Network B sends data to Network A through the second optical switch. The front-end machine and back-end machine of the first optical switch are configured with a storage path named after the interface name of Application B in Network B, and the front-end machine and back-end machine of the second optical switch are configured with a storage path named after the interface name of Application A in Network A;

[0014] 2) Application A encapsulates service files or service interface data, the interface name of Application B, and the authentication parameters of Secure Sharing and Exchange Service A, and sends a file transmission request to Push Module A of Secure Sharing and Exchange Service A through the HTTP / HTTPS protocol;

[0015] 3) Push Module A of Secure Sharing and Exchange Service A parses the received file transmission request to obtain authentication parameters, and verifies the legitimacy of the request according to the authentication parameters. If the verification fails, it returns authentication failure; if the authentication passes, it proceeds to step 4);

[0016] 4) Push Module A retrieves according to the interface name parsed from the request in the registration information on Secure Sharing and Exchange Service A. If the interface name exists in the registration information on Secure Sharing and Exchange Service A, it proceeds to step 5);

[0017] 5) Push Module A reads the transmitted service file or encapsulates the service interface data into a JSON file and pushes it to the storage path named after the service interface of the front-end machine of the first optical switch, and records the service interface name, transmission file name, and time of transmission;

[0018] 6) The monitoring module B of the secure sharing and exchange service B monitors the post machine of the optical isolation device on the network B side. When a new file is detected, it obtains the interface name corresponding to the new file, and then encapsulates the new file and its corresponding interface name and sends a file push request to the push module B of the secure sharing and exchange service B through the HTTP / HTTPS protocol.

[0019] 7) The push module B of the secure sharing and exchange service B parses the interface name obtained from the received file push request and the service file or service interface data in the new file, obtains the URL corresponding to the interface name from the database of the network B, and sends a file processing request to the application B through the HTTP / HTTPS protocol for the transmission object; the transmission object is the service file or service interface data.

[0020] 8) After receiving the file processing request, the application B encapsulates the processing result, the interface name of the application A, and the authentication parameters of the sharing and exchange service B, and sends a processing result transmission request to the push module B of the secure sharing and exchange service B through the HTTP / HTTPS protocol.

[0021] 9) The push module B receives and parses the processing result transmission request, encapsulates the processing result data and the interface name into a JSON file according to the sending time, and pushes it to the storage path named by the interface on the second optical isolation device front machine.

[0022] 10) The monitoring module A of the secure sharing and exchange service A monitors the post machine of the second optical isolation device. When a new file is detected, it parses the content of the new file to obtain the interface name, and encapsulates the new file and the interface name and sends a data push request to the push module A of the secure sharing and exchange service A through the HTTP / HTTPS protocol.

[0023] 11) The push module A parses the data push request sent by the monitoring module A, obtains the interface name and the processing result; then obtains the corresponding interface URL from the database of the network A according to the interface name, and sends the processing result to the application A through the HTTP / HTTPS protocol.

[0024] Further, the registered interface information includes the sending end interface name, the sending end interface URL, the receiving end interface name, and the receiving end interface URL.

[0025] Further, the front machine and the post machine of the network are configured with a storage path named by the receiving end interface name.

[0026] Further, the monitoring module B obtains the interface name according to the storage path of the new file.

[0027] Further, in step 2), when a service file needs to be transmitted, Application A encapsulates the service file, interface name, and authentication parameters in the form of form-data; when service interface data needs to be transmitted, Application A encapsulates the interface name, authentication parameters, and service interface data in the form of JSON.

[0028] Further, in step 6), when it is detected that a new file is a non-JSON file, Monitoring Module B reads the content of the new file as a parameter, encapsulates the parameter and the interface name using HTTP / HTTPS, and sends them to the processing file interface of Push Module B; when it is detected that a new file is a JSON file, Monitoring Module B parses the JSON file and uses the parsed result and the interface name as request parameters to call the processing request interface of Push Module B in the form of HTTP / HTTPS.

[0029] A secure sharing and exchange system based on a dual one-way optical gate, characterized in that it includes an optical gate and a sharing and exchange service unit, and the sharing and exchange service unit includes a push module and a monitoring module;

[0030] The optical gate is used to isolate two networks; in each of the networks, a sharing and exchange service unit is deployed, and the interface information of the service applications that need to interact across the optical gate is registered on the sharing and exchange service; each of the networks includes a database for storing registration information, transmission records, application names of transmissions, transmission status, transmission time, transmission content, and return results; the two networks are respectively denoted as Network A and Network B, the sharing and exchange service deployed in Network A domain is denoted as Secure Sharing and Exchange Service A, and the sharing and exchange service deployed in Network B domain is denoted as Secure Sharing and Exchange Service B; Network A sends data to Network B through the first optical gate, and Network B sends data to Network A through the second optical gate. The front-end and back-end machines of the first optical gate are configured with a storage path named after the interface name of Application B in Network B, and the front-end and back-end machines of the second optical gate are configured with a storage path named after the interface name of Application A in Network A;

[0031] The push module A of the secure sharing and exchange service A is used to receive the file transfer request sent by Application A in Network A domain after encapsulating the service file or service interface data, the receiving end interface name, and the authentication parameters of the secure sharing and exchange service A through the HTTP / HTTPS protocol; and to parse the received file transfer request to obtain the authentication parameters, verify the legitimacy of the request according to the authentication parameters, return authentication failure if the verification fails, and if the authentication passes, retrieve according to the interface name parsed from the request in the registration information on the secure sharing and exchange service A. If the interface name exists in the registration information on the secure sharing and exchange service A; then read the transferred service file or encapsulate the service interface data into a JSON file and push it to the storage path named after the service interface in the front-end machine of the first air gap, and record the service interface name, the transferred file name, and the time of transfer; and to parse the data push request sent by the monitoring module A, obtain the interface name and the processing result; then obtain the corresponding interface URL from the database of Network A according to the interface name, and send the processing result to Application A through the HTTP / HTTPS protocol;

[0032] The monitoring module A is used to monitor the back-end machine of the second air gap. When a new file is detected, parse the content of the new file to obtain the interface name, and encapsulate the new file and the interface name and send a data push request to the push module A of the secure sharing and exchange service A through the HTTP / HTTPS protocol;

[0033] The monitoring module B of the secure sharing and exchange service B is used to monitor the back-end machine of the air gap on the Network B side. When a new file is detected, obtain the interface name corresponding to the new file, and then encapsulate the new file and its corresponding interface name and send a file push request to the push module B of the secure sharing and exchange service B through the HTTP / HTTPS protocol;

[0034] The push module B is used to obtain the interface name parsed from the received file push request and the service file or service interface data in the new file, obtain the URL corresponding to the interface name from the database of Network B, and send a file processing request to Application B through the HTTP / HTTPS protocol for the transfer object; the transfer object is the service file or service interface data; and to receive and parse the processing result transfer request, encapsulate the processing result data and the interface name into a JSON file according to the sending time and push it to the storage path named after the interface in the front-end machine of the second air gap.

[0035] The advantages of the present invention are as follows:

[0036] This solution takes into account the security of data transmission. On the basis of fully protecting the data in the high-security domain, it realizes transmission based on the TCP / IP protocol, reduces the intrusion into the application code, and can monitor the transmission status at the same time. After the receiving side receives and processes the file, it makes a callback to transmit the relevant content, forming a transmission closed-loop. Description of the Drawings

[0037] Figure 1 It is the workflow diagram of the security exchange service. Detailed Implementation Modes

[0038] The present invention will be further described in detail below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0039] The core of the present invention is to realize the secure interaction of the service applications on both sides of the optical gate supporting the TCP / IP protocol without exposing the service application IP and ports in the network domains on both sides of the optical gate to each other. The present invention supports processing file transfer and API interface data interaction, has the characteristics of low code intrusion, and at the same time provides a data transmission monitoring function to monitor the transmission status, transmission time, etc. of the data, ensuring the integrity of data transmission and closed-loop management of transmission.

[0040] The security sharing and exchange service based on the dual-unidirectional isolation optical gate is deployed in each of the different security domains on both sides of the optical gate. Figure 1 As shown in the workflow diagram of the security exchange service, the service application A (referred to as application A for short) and the security sharing and exchange service A are deployed in the network A domain of the sending end, and the service application B (referred to as application B for short) and the security sharing and exchange service B are deployed in the network B domain of the receiving end.

[0041] The technical solution provided by the present invention is as follows:

[0042] (1) Register the interface information of the service applications that need to interact across the optical gate on the sharing and exchange service, including the interface names (globally unique) and interface URLs of the sending end (application A) and the receiving end (application B), etc. The above information is stored in the database; after registration, configure the storage paths named after the interface name of the receiving end (application B) on the front-end and back-end machines of the first optical gate, and configure the storage paths named after the interface name of the sending end (application A) on the front-end and back-end machines of the second optical gate. In addition to the registration information, the database will also store transmission records, including the application name, transmission status, transmission time, transmission content, and return results of the transmission.

[0043] (2) Application A encapsulates the service file or service interface data to be transmitted to application B, the interface name of application B, and the authentication parameters of the sharing and exchange service in a specific format (such as JSON), and sends a file transfer request to the push module of the security sharing and exchange service A through the HTTP / HTTPS protocol.

[0044] (3) The push module of the secure sharing and exchange service A receives the file transfer request and parses it to obtain information such as authentication parameters, interface names, business files, or business interface data.

[0045] (4) The push module of the secure sharing and exchange service A verifies the legality of the file transfer request according to the authentication parameters. If the verification fails, the push module returns an authentication failure message; if the verification passes, the subsequent processing step (5) is performed. Among them, the authentication method can be TOKEN or ciphertext.

[0046] (5) The push module of the secure sharing and exchange service A retrieves the interface name according to the registration information in step (1). If it exists, it proceeds to the next step; if it does not exist, an error message is returned.

[0047] (6) The push module of the secure sharing and exchange service A reads the transferred business file or encapsulates the business interface data into a JSON file and pushes it to the storage path named after the business interface of the first air gap front-end machine.

[0048] (7) The push module of the secure sharing and exchange service A records and stores the business interface name, the name of the transferred file (business file or JSON file), and the time of transfer.

[0049] (8) The monitoring module B of the secure sharing and exchange service B monitors the back-end machine of the air gap on the network B side. When a new file (i.e., the business file or the JSON file encapsulating the business interface data described in step 6) is detected, the interface name is obtained according to the storage path of the new file, and the new file and the interface name are encapsulated and sent to the push module B of the secure sharing and exchange service B as a file push request through the HTTP / HTTPS protocol.

[0050] (9) The push module B of the secure sharing and exchange service B receives the file push request from the monitoring module B and parses it to obtain the interface name and the business file or business interface data in the new file. The corresponding interface URL is obtained from the database in step (1) through the interface name, and the business file or business interface data is sent to application B as a file processing request through the HTTP / HTTPS protocol.

[0051] (10) After receiving the file processing request, application B encapsulates the processing result, the interface name of application A, and the authentication parameters of the sharing and exchange service B in a specific format and sends a processing result transmission request to the push module B of the secure sharing and exchange service B through the HTTP / HTTPS protocol.

[0052] (11) The push module B of the secure sharing and exchange service B receives the processing result transmission request and parses it, encapsulates the processing result data and interface name into a JSON file according to the sending time, and pushes it to the storage path named after the interface of the second optical isolation pre-processor.

[0053] (12) The monitoring module A of the secure sharing and exchange service A monitors the post-processor of the second optical isolation. When a new file is detected, it parses the content of the new file to obtain the interface name, and after encapsulating the new file and the interface name, it sends a data push request to the push module A of the secure sharing and exchange service A through the HTTP / HTTPS protocol.

[0054] (13) The push module A of the secure sharing and exchange service A parses the data push request sent by the monitoring module A, and obtains the interface name and processing result. The push module A obtains the corresponding interface URL from the database of network A according to the interface name, and sends the processing result to application A through the HTTP / HTTPS protocol.

[0055] (14) Thus, application A obtains the processing result of application B.

[0056] Further, in the above step (1), to ensure that the URL information does not pass through the optical isolation, the interface names of each application B, the interface names of each application A, and the interface URLs are stored in the secure sharing and exchange service A, and the interface names of each application B, the interface URLs, and the interface names of application A are stored in the secure sharing and exchange service B;

[0057] Further, in the above step (2), for the case where application A transmits business files, application A encapsulates the business file, interface name, and authentication parameters in the form of form-data; for the case where application A needs to send business interface data, application A encapsulates the interface name, authentication parameters, and business interface data in the form of JSON.

[0058] Further, in the above step (7), when the received file is a non-JSON file, the monitoring module reads the file content, encapsulates the parameter and the interface name using the HTTP / HTTPS protocol, and sends it to the processing file interface of the push module; when the received file is a JSON file, the monitoring module parses the JSON file, and uses the parsed result and the interface name as request parameters, and calls the processing request interface of the push module using the HTTP / HTTPS protocol.

[0059] Although specific embodiments of the present invention are disclosed for illustrative purposes, which are intended to assist in understanding the content of the present invention and implementing it accordingly, those skilled in the art can understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the content disclosed in the best embodiments, and the scope of protection claimed by the present invention shall be defined by the scope defined in the claims.

Claims

1. A secure shared exchange method based on dual one-way optical gates, the steps comprising: 1) Deploy a shared exchange service in each of the two networks isolated by the optical gate, and register the interface information of the business application that needs to interact across the optical gate on the shared exchange service; Each of the networks includes a database for storing registration information, transmission records, transmission application names, transmission status, transmission time, transmission content, and return results; the two networks are respectively denoted as network A and network B, the shared exchange service deployed in the network A domain is denoted as secure shared exchange service A, and the shared exchange service deployed in the network B domain is denoted as secure shared exchange service B; network A sends data to network B via a first optical gate, and network B sends data to network A via a second optical gate, the front-end and back-end of the first optical gate are configured with a storage path named after the interface name of application B in network B, and the front-end and back-end of the second optical gate are configured with a storage path named after the interface name of application A in network A; 2) Application A encapsulates the business file or business interface data, the interface name of application B, and the authentication parameters of shared exchange service A, and sends a file transfer request to push module A of secure shared exchange service A through HTTP / HTTPS protocol; 3) Push module A of secure shared exchange service A parses the received file transfer request to obtain authentication parameters, verifies the legitimacy of the request based on the authentication parameters, and returns authentication failure if the verification fails; if the authentication passes, proceeds to step 4); 4) Push module A searches the registration information on secure shared exchange service A according to the interface name parsed from the request. If the interface name exists in the registration information on secure shared exchange service A, the process proceeds to step 5); 5) Push module A reads the transmitted business file or encapsulates the business interface data into a JSON file and pushes it to the front-end processor of the first optical gate under the storage path named after the business interface, and records the business interface name, transmission file name, and transmission time; 6) The monitoring module B of the secure shared exchange service B monitors the backend of the optical gate on the network B side. When a new file is detected, the interface name corresponding to the new file is obtained, and then the new file and its corresponding interface name are encapsulated and a file push request is sent to the push module B of the secure shared exchange service B through the HTTP / HTTPS protocol; 7) Push module B of secure shared exchange service B parses the received file push request to obtain the interface name and the business file or business interface data in the new file, obtains the URL corresponding to the interface name from the database of network B, and sends a file processing request to application B via HTTP / HTTPS protocol for the transmission object; the transmission object is the business file or business interface data; 8) After receiving the file processing request, application B encapsulates the processing result, the interface name of application A and the authentication parameters of shared exchange service B, and sends the processing result transmission request to push module B of secure shared exchange service B through HTTP / HTTPS protocol; 9) Push module B receives the processing result transmission request and parses it, encapsulates the processing result data and the interface name into a JSON file according to the sending time, and pushes it to the storage path named after the interface in the second optical gate front-end; 10) The monitoring module A of the secure shared exchange service A monitors the backend of the second optical gate, and when a new file is detected, parses the content of the new file to obtain the interface name, encapsulates the new file and the interface name, and sends a data push request to the push module A of the secure shared exchange service A via the HTTP / HTTPS protocol; 11) Push module A parses the data push request sent by monitoring module A, obtains the interface name and processing result; then obtains the corresponding interface URL from the database of network A according to the interface name, and sends the processing result to application A via HTTP / HTTPS protocol.

2. The method according to claim 1, characterized in that The registered interface information includes the sender interface name, sender interface URL, receiver interface name, and receiver interface URL.

3. The method according to claim 2, characterized in that The front-end processor and the back-end processor of the network are configured with a storage path named after the receiving end interface name.

4. The method according to claim 1, 2 or 3, characterized in that: Monitoring module B obtains the interface name according to the storage path of the new file.

5. The method according to claim 1, 2 or 3, characterized in that: In step 2), when a business file needs to be transmitted, application A encapsulates the business file, interface name and authentication parameters in the form-data format; When the business interface data needs to be transmitted, application A encapsulates the interface name, authentication parameters, and business interface data in JSON format.

6. The method according to claim 1, 2 or 3, characterized in that: In step 6), when it is detected that a new file is not a JSON file, the monitoring module B reads the content of the new file as a parameter, uses HTTP / HTTPS to encapsulate the parameter and the interface name, and sends them to the file processing interface of the push module B; when it is detected that a new file is a JSON file, the monitoring module B parses the JSON file, and uses the parsed result and the interface name as request parameters to call the processing request interface of the push module B via HTTP / HTTPS.

7. A secure shared exchange system based on dual one-way optical gates, characterized in that: It includes an optical gate and a shared exchange service unit, wherein the shared exchange service unit includes a push module and a monitoring module; The optical gate is used to isolate two networks; a shared exchange service unit is deployed in each of the networks, and interface information of business applications that need to interact across the optical gate is registered on the shared exchange service; each of the networks includes a database for storing registration information, transmission records, transmission application names, transmission status, transmission time, transmission content and return results; the two networks are respectively recorded as network A and network B, the shared exchange service deployed in the network A domain is recorded as secure shared exchange service A, and the shared exchange service deployed in the network B domain is recorded as secure shared exchange service B; network A sends data to network B via the first optical gate, and network B sends data to network A via the second optical gate, the front-end and back-end of the first optical gate are configured with a storage path named after the interface name of application B in network B, and the front-end and back-end of the second optical gate are configured with a storage path named after the interface name of application A in network A; The push module A of the secure shared exchange service A is used to receive the file transfer request sent by the HTTP / HTTPS protocol by the application A in the network A domain to encapsulate the business file or business interface data, the receiving end interface name, and the authentication parameters of the shared exchange service A; and parse the received file transfer request to obtain the authentication parameters, verify the legitimacy of the request according to the authentication parameters, and return the authentication failure if the verification fails. If the authentication passes, the registration information on the secure shared exchange service A is retrieved according to the interface name parsed from the request, if the interface name exists in the registration information on the secure shared exchange service A; then read the transmitted business file or encapsulate the business interface data into a JSON file and push it to the front-end of the first optical gate under the storage path named after the business interface, and record the business interface name, transmission file name, and transmission time; And parse the data push request sent by monitoring module A, obtain the interface name and processing result; then obtain the corresponding interface URL from the database of network A according to the interface name, and send the processing result to application A via HTTP / HTTPS protocol; The monitoring module A is used to monitor the backend of the second optical gate. When a new file is detected, the monitoring module A parses the content of the new file to obtain the interface name, encapsulates the new file and the interface name, and sends a data push request to the push module A of the secure shared exchange service A through the HTTP / HTTPS protocol; The monitoring module B of the secure shared exchange service B is used to monitor the backend machine located at the optical gate on the network B side. When a new file is detected, the interface name corresponding to the new file is obtained, and then the new file and its corresponding interface name are encapsulated and a file push request is sent to the push module B of the secure shared exchange service B through the HTTP / HTTPS protocol; Push module B is used to parse the received file push request to obtain the interface name and the business file or business interface data in the new file, obtain the URL corresponding to the interface name from the database of network B, and send the file processing request to application B through the HTTP / HTTPS protocol for the transmission object; the transmission object is the business file or business interface data; And receive and parse the processing result transmission request, encapsulate the processing result data and the interface name into a JSON file according to the sending time, and push it to the storage path named after the interface in the second optical gate front-end.

8. The system according to claim 7, characterized in that The registered interface information includes the sender interface name, sender interface URL, receiver interface name, and receiver interface URL.

9. The system according to claim 8, characterized in that The front-end processor and the back-end processor of the network are configured with a storage path named after the receiving end interface name.

Images