Embedded data isolation one-way transmission device and transmission method thereof
Through the embedded data isolation unidirectional transmission device, the FPGA and optocoupler are used to realize unidirectional transmission of data, which solves the problem of complex equipment and inability to use in the prior art, and realizes reliable unidirectional transmission of high-security data, which is suitable for data transmission in maneuver scenarios.
Patent Information
- Application Number
- CN202510219292.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-26
- Publication Date
- 2025-07-08
AI Technical Summary
The prior art security isolation equipment is complex and large, unable to be applied to mobile or fast-use scenarios, and cannot effectively prevent the unidirectional transmission of high-security data to low-security networks.
The embedded data isolation unidirectional transmission device is adopted, and the FPGA and optocoupler are used to realize unidirectional transmission of data. Data identification and verification are performed through FPGA. Combined with the unidirectional transmission characteristics of the optocoupler, it ensures that data can only be transmitted from a low-security-level network to a high-security-level network.
It realizes safe and reliable one-way transmission of data, prevents high-security data leakage, is suitable for sensitive data transmission in maneuverable scenarios, and has a small size and low cost.
Smart Images
Figure CN120277685A_ABST
Abstract
Description
Technical Field
[0001] The present invention belongs to the technical field of data security communication, and particularly relates to an embedded data isolation unidirectional transmission device and a transmission method thereof. Background Art
[0002] With the development and popularization of cloud technology applications, more and more industries need to converge massive amounts of data to the cloud and extract and apply it through intelligent computing models. Since the data sources are numerous different business subsystems or completely dispersed end nodes, for security or privacy purposes, it is necessary to ensure data isolation between each other and perform unidirectional transmission intelligently. And after massive amounts of end data are converged and screened and analyzed, highly sensitive data information can be extracted, and it is necessary to ensure the security of this data and ensure that it will not be transmitted and spread in reverse. Therefore, the data isolation unidirectional transmission technology has emerged.
[0003] In some special industries, it is necessary to converge various data in a mobile scenario, and the security levels of the data sources are different. To prevent the leakage of high-security-level data to low-security-level business systems, the problem of security isolation must be solved, and the most core of which is the unidirectional data transmission design. Unidirectional data transmission is a new type of network security isolation product. Its principle is to essentially design the hardware and communication protocols of traditional computer network two-way communication as unidirectional sending and unidirectional receiving. Data can only be unidirectionally transmitted from a low-security-level network to a high-security-level network, which can effectively prevent the leakage of sensitive information in the high-level network. Since there is no reverse channel in unidirectional transmission, attackers cannot obtain the relevant information necessary for attacks online. Even if viruses or trojans are "blindly" injected into the high-security-level network, since the underlying hardware does not have the ability to transmit data from the high-security-level network to the low-security-level network in reverse, to a certain extent, most network security attack behaviors will also be meaningless.
[0004] Currently, the common security isolation devices on the market are complex and large, mostly fixed facilities, and cannot be applied in mobile or scenarios that require quick use. Therefore, there is an urgent need for a method that is both lightweight and can ensure effective unidirectional data transmission, so as to guarantee data security and prevent the leakage of high-security-level data to low-security-level networks. Summary of the Invention
[0005] The purpose of the present invention is to overcome the above-mentioned disadvantages of the prior art and provide an embedded data isolation unidirectional transmission device and a transmission method thereof.
[0006] To achieve the above purpose, the present invention provides the following technical solutions:
[0007] On the one hand, the present invention provides an embedded data isolation unidirectional transmission device, including an FPGA for processing data security and attack detection, an optical coupler electrically connected to the FPGA, and an external power supply. Both the FPGA and the optical coupler are provided with data interfaces, and data isolation is achieved through the unidirectional transmission of data between the FPGA and the optical coupler.
[0008] Specifically, the ninety-first pin of the FPGA receives the data to be transmitted through the serial port UART RXD_3568, the ninetieth pin is connected to the serial port UART TXD_3568 through a three-hundred-ohm resistor (0Ω), the eighty-sixth pin of the FPGA outputs the logical signal processed by the FPGA through the serial port UART_RXD_FP1, the eighty-second pin is connected to the serial port UART_TXD_FP1 through a three-hundred-and-one-ohm resistor (0Ω), and the twenty-first pin, twenty-fifth pin, thirty-first pin, sixty-second pin, sixty-ninth pin, seventy-fifth pin, eighty-fourth pin, and one-hundredth pin of the FPGA are all grounded.
[0009] Further, the ninety-first pin is connected to the serial port UART RXD_3568 through an eighty-ohm resistor (0Ω), and the eighty-sixth pin of the FPGA is connected to the serial port UART_RXD_FP1 through an eighty-one-ohm resistor (0Ω).
[0010] Specifically, the model of the optical coupler is ELM453L.
[0011] Further, the first pin of the optical coupler is connected to the power supply (VCC3V3_2) through a one-hundred-and-twenty-one-ohm resistor (150Ω), the third pin inputs the logical signal processed by the FPGA through the serial port UART_RXD_FP1, the third pin is grounded through a one-hundred-and-twenty-two-ohm resistor (120Ω), the fourth pin is grounded, the fifth pin outputs the processed logical signal through the serial port UART_RXD_FT_1, the fifth pin is also grounded through a two-hundred-and-twenty-one capacitor (15pF), the sixth pin is connected to the power supply (VCC3V3_2), a two-hundred-and-twenty capacitor (0.1μF) is connected in series between the fourth pin and the sixth pin, and a one-hundred-and-twenty-three resistor (1K) is connected in series between the fifth pin and the sixth pin.
[0012] Specifically, the model of the optical coupler is ELM453L.
[0013] On the other hand, the present invention provides a transmission method for an embedded data isolation unidirectional transmission device, which is as follows:
[0014] Information to be transmitted is sent from the processor to the FPGA through the serial port UART RXD_3568. The data is identified and verified by the FPGA. If the data content does not meet the requirements set by the private protocol, the data is discarded; if the data content meets the requirements set by the private protocol, it is verified whether the data is incorrect or tampered with; if it is found that the data is incorrect or tampered with after verification, the data is discarded. If the data is error-free and not tampered with after verification, the filtered logical signal is input into the optocoupler through the serial port UART_RXD_FP1; the input logical signal serial port UART_RXD_FP1 of the optocoupler is a logical input that must be isolated, and the output logical signal serial port is UART_RXD_FT_1. These two logical signals are where isolation occurs.
[0015] When the logical input of the optocoupler is low, the light-emitting diode in the optocoupler is not conducting, and the photosensitive triode in the optocoupler is also in the off state, so the logical output voltage is high.
[0016] When the logical input of the optocoupler is high, the light-emitting diode conducts, and the photosensitive triode turns on, so the logical output voltage is zero.
[0017] Therefore, the logical input is reflected in the logical output, and isolation between the two is still provided; as the input logical signal changes between high and low through the serial port UART_RXD_FP1, the logical output serial port UART_RXD_FT_1 will generate corresponding high and low levels, thereby transmitting the data. That is, the logical signal output by the optocoupler is sent to the main processor.
[0018] If the logical signal flows back into the optocoupler in the reverse direction, the optocoupler does not conduct, and the FPGA does not support the data reverse transmission channel either, thus ensuring that the data can only be transmitted unidirectionally and is isolated from electromagnetic signals and cannot be leaked.
[0019] On the other hand, the present invention provides an application of an embedded data isolation unidirectional transmission device for preventing the leakage of network data with a high security level to a network with a low security level.
[0020] Compared with the prior art, the technical solution provided by the present invention has the following beneficial effects:
[0021] The embedded data isolation unidirectional transmission device of the present invention utilizes the unidirectional transmission characteristic of the optocoupler to enable the data to be transmitted only unidirectionally. Combining with the programmable logic characteristic of the FPGA can effectively prevent malicious network attacks and data leakage. Moreover, neither the optocoupler nor the FPGA provides a data transmission loop. Therefore, the present invention can achieve safe and reliable unidirectional transmission of data. In addition, the circuit selected by the present invention is relatively simple, small in size, and low in cost, and can be integrated into handheld, backpack or vehicle-mounted devices to meet the use requirements of unidirectional transmission of sensitive data in mobile scenarios. BRIEF DESCRIPTION OF THE DRAWINGS
[0022] The drawings herein are incorporated into and form a part of this specification, and are used together with the specification to explain the principles of the present invention.
[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.
[0024] Figure 1 Schematic diagram of the unidirectional transmission principle of the present invention;
[0025] Figure 2 Data transmission flow chart of the present invention;
[0026] Figure 3 Schematic diagram of the implementation of the unidirectional transmission circuit of the present invention;
[0027] Figure 4 Frame diagram of the service system isolation realized by the unidirectional transmission module of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS
[0028] Here, the exemplary embodiments will be described in detail, and the examples are shown in the drawings. The implementation manners described in the following exemplary embodiments do not represent all implementation manners consistent with the present invention. On the contrary, they are only examples consistent with some aspects of the present invention detailed in the appended claims.
[0029] In order to enable those skilled in the art to better understand the technical solutions of the present invention, the present invention will be further described in detail below with reference to the drawings and embodiments.
[0030] Embodiment
[0031] Refer to Figure 1 As shown, this embodiment provides an embedded data isolation unidirectional transmission device, including an FPGA for processing data security and attack detection, an optical coupler electrically connected to the FPGA, and an external power supply. Both the FPGA and the optical coupler are provided with data interfaces, and data isolation is achieved through the unidirectional transmission of data between the FPGA and the optical coupler.
[0032] Specifically, the ninety-first pin of the FPGA receives the data to be transmitted through the serial port UART RXD_3568. The ninetieth pin is connected to the serial port UART TXD_3568 through the three-hundredth resistor R300 (0Ω). The eighty-sixth pin of the FPGA outputs the logic signal processed by the FPGA through the serial port UART_RXD_FP1. The eighty-second pin is connected to the serial port UART_TXD_FP1 through the three-hundred-and-first resistor R301 (0Ω). The twenty-first pin, twenty-fifth pin, thirty-first pin, sixty-second pin, sixty-ninth pin, seventy-fifth pin, eighty-fourth pin, and one-hundredth pin of the FPGA are all grounded.
[0033] Further, the ninety-first pin is connected to the serial port UART RXD_3568 through the eightieth resistor R80 (0Ω). The eighty-sixth pin of the FPGA is connected to the serial port UART_RXD_FP1 through the eighty-first resistor R81 (0Ω).
[0034] Specifically, the model of the optocoupler is ELM453L.
[0035] Furthermore, the first pin of the optocoupler is connected to the power supply VCC3V3_2 through the one-hundred-and-twenty-first resistor R121 (150Ω). The third pin inputs the logic signal processed by the FPGA through the serial port UART_RXD_FP1. The third pin is grounded through the one-hundred-and-twenty-second resistor R122 (120Ω). The fourth pin is grounded. The fifth pin outputs the processed logic signal through the serial port UART_RXD_FT_1. The fifth pin is also grounded through the two-hundred-and-twenty-first capacitor C221 (15pF). The sixth pin is connected to the power supply VCC3V3_2. A two-hundred-and-twentieth capacitor C220 (0.1μF) is connected in series between the fourth pin and the sixth pin. A one-hundred-and-twenty-third resistor R123 (1K) is connected in series between the fifth pin and the sixth pin.
[0036] Specifically, as Figure 1 shown, the signal socket P16B is provided with pins for transmitting the logic signals processed by multiple groups of FPGAs and optocouplers to a high-security-level network. Specifically: for the first group of FPGA1 and optocoupler, the C1 pin is connected to the serial port UART_TXD_FT_1, the C2 pin is connected to the serial port UART_RXD_FT_1, and the C3 pin is grounded;
[0037] For the second group of FPGA2 and optocoupler, the C4 pin is connected to the serial port UART_TXD_FT_2, the C5 pin is connected to the serial port UART_RXD_FT_2, and the C6 pin is grounded;
[0038] Pin C7 is connected to the serial port UART_TX_3V3_BD, pin C8 is connected to the serial port UART_RX_3V3_BD, pin C9 is grounded, and pin C10 is connected to TX EN.
[0039] See Figure 2 and Figure 3 As shown, this embodiment also provides a transmission method for an embedded data isolation unidirectional transmission device, which is as follows:
[0040] The information to be transmitted is sent from the processor to the FPGA through the serial port UART RXD_3568. The data is identified and verified by the FPGA. If the data content does not meet the requirements set by the private protocol, the data is discarded; if the data content meets the requirements set by the private protocol, it is verified whether the data is incorrect or tampered with; if it is found that the data is incorrect or tampered with after verification, the data is discarded. If the data is error-free or not tampered with after verification, the filtered logical signal is input to the optocoupler through the serial port UART_RXD_FP1; the input logical signal of the optocoupler, serial port UART_RXD_FP1, is a logical input that must be isolated, and the output logical signal serial port is UART_RXD_FT_1. These two logical signals are the places where isolation occurs.
[0041] When the logical input of the optocoupler is low, the light-emitting diode in the optocoupler is not conducting, and the phototransistor in the optocoupler is also in the off state, so the logical output voltage is high;
[0042] When the optocoupler logical input is high, the light-emitting diode conducts, and the phototransistor turns on, so the logical output voltage is zero;
[0043] Therefore, the logical input is reflected in the logical output, and isolation between the two is still provided; as the input logical signal changes between high and low through the serial port UART_RXD_FP1, the logical output serial port UART_RXD_FT_1 will generate corresponding high and low levels, thereby transmitting the data, that is, the logical signal output by the optocoupler is sent to the main processor;
[0044] If the logical signal flows back into the optocoupler in the reverse direction, the optocoupler does not conduct, and the FPGA also does not support the data reverse transmission channel, thus ensuring that the data can only be transmitted unidirectionally and is isolated from electromagnetic signals and cannot leak.
[0045] It should be added that this embodiment can isolate two independent service systems in actual applications. See Figure 4 shown;
[0046] The A service system network where the slave processor 1 of terminal 1 is located is a low-security-level information network, and the generated or collected data can be reported to the master processor 1 in the high-security-level information network where the B service system network is located through the unidirectional transmission circuit 1 respectively;
[0047] The A service system network where the slave processor 2 of terminal 2 is located is a low-security-level information network, and the generated or collected data can be reported to the master processor 2 in the high-security-level information network where the B service system network is located through the unidirectional transmission circuit 2 respectively;
[0048] The master processor 1 and the master processor 2 are connected to the data center through wire or wireless in the B service system network; the slave processor 1 and the slave processor 2 interact through wire or wireless in the A service system network; due to the existence of the unidirectional transmission circuit 1 and the unidirectional transmission circuit 2, the high-security network data of the B service system will not be leaked to the low-security-level A network.
[0049] It should also be noted that the respective pins of the above FPGA are not limited to the existing connection relationships, and can also be adjusted according to specific projects or actual situations, and cooperate with the optocoupler to achieve data isolation as the standard.
[0050] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention.
Claims
1. An embedded data isolation unidirectional transmission device, characterized in that It includes an FPGA for processing data security and attack detection, an optocoupler electrically connected to the FPGA, and an external power supply. Both the FPGA and the optocoupler are provided with data interfaces, and data isolation is achieved through the unidirectional data transmission between the FPGA and the optocoupler.
2. The embedded data isolation unidirectional transmission device according to claim 1, wherein The ninety-first pin of the FPGA receives the data to be transmitted, the eighty-sixth pin of the FPGA outputs the logic signal processed by the FPGA, and the twenty-first pin, twenty-fifth pin, thirty-first pin, sixty-second pin, sixty-ninth pin, seventy-fifth pin, eighty-fourth pin, and one-hundredth pin of the FPGA are all grounded.
3. The embedded data isolation unidirectional transmission device according to claim 2, wherein The ninety-first pin receives the data to be transmitted through an eighty-ohm resistor, and the eighty-sixth pin of the FPGA outputs the logic signal processed by the FPGA through an eighty-one-ohm resistor.
4. The embedded data isolation unidirectional transmission device according to claim 1, characterized in that The model of the optocoupler is ELM453L.
5. The embedded data isolation unidirectional transmission device according to claim 4, characterized in that, The first pin of the optocoupler is connected to the power supply through a one-hundred-and-twenty-one-ohm resistor, the third pin inputs the logic signal processed by the FPGA, the third pin is grounded through a one-hundred-and-twenty-two-ohm resistor, the fourth pin is grounded, the fifth pin outputs the processed logic signal, the fifth pin is also grounded through a two-hundred-and-twenty-one capacitor, the sixth pin is connected to the power supply, a two-hundred-and-twenty capacitor is connected in series between the fourth pin and the sixth pin, and a one-hundred-and-twenty-three-ohm resistor is connected in series between the fifth pin and the sixth pin.
6. The transmission method of the embedded data isolation unidirectional transmission device according to any one of claims 1-5, characterized in that, Specifically as follows: The information to be transmitted from the processor is sent to the FPGA through the data interface. The data is identified and verified by the FPGA. If the data content does not meet the requirements, the data is discarded. If the data content meets the requirements, the filtered logic signal is input to the optocoupler, and the logic signal output by the optocoupler is then sent to the main processor; If the logic signal flows back into the optocoupler in the reverse direction, the optocoupler is not turned on, and the FPGA also does not support the reverse transmission of data, thus ensuring the unidirectional transmission of data and achieving data isolation.
7. The transmission method of the embedded data isolation unidirectional transmission device according to claim 6, characterized in that, When the logic input of the optocoupler is low, the light-emitting diode in the optocoupler is not turned on, and the phototransistor in the optocoupler is also in the off state, so the logic output voltage is high; When the logic input of the optocoupler is high, the light-emitting diode is turned on, and the phototransistor is turned on, so the logic output voltage is zero; Therefore, with the change of the high and low levels of the input logic signal, the corresponding high and low levels will be generated at the logic output, thereby transmitting the data.
8. The transmission method of the embedded data isolation unidirectional transmission device according to claim 6, characterized in that, The data is identified and verified by the FPGA specifically as follows: If the data content does not meet the requirements set by the private protocol, the data is discarded; if the data content meets the requirements set by the private protocol, it is verified whether the data is incorrect or tampered with; if it is found that the data is incorrect or tampered with after verification, the data is discarded, and if the data is error-free or not tampered with after verification, the filtered logic signal is input to the optocoupler.
9. The application of the embedded data isolation unidirectional transmission device according to any one of claims 1-5, characterized in that, It is applied to prevent the leakage of network data with a high security level to a network with a low security level.