A cross-domain bidirectional data transmission method, device and storage medium

Abstract

The application relates to the technical field of cross-domain data transmission, and discloses a cross-domain bidirectional data transmission method, equipment and a storage medium, wherein the method comprises the following steps: a logical isolation channel between a source domain and a target domain is established through multi-network card deployment, and shared storage permissions and transmission strategies are initialized; the logical isolation channel comprises a first transmission channel and a second transmission channel; the source domain standardizes and encapsulates data to generate standardized data and metadata, and unidirectionally transmits the standardized data and the metadata to the target domain through the first transmission channel; the target domain restores original protocol streams based on the standardized data and the metadata transmitted by the source domain, and performs cross-domain business operations; the target domain generates return data and performs verification, and after verification, the return data is unidirectionally returned to the source domain through the second transmission channel. The application realizes cross-domain bidirectional data transmission based on multi-network card software and hardware cooperation and distributed storage, and can realize bidirectional transmission of data between different application domains and different security levels, multi-level security isolation and protocol conversion in a cross-domain scene.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cross-domain data transmission, and in particular to a cross-domain bidirectional data transmission method, device and storage medium. BACKGROUND

[0002] Under the background of increasingly complex data security and information security needs, cross-domain data transmission has become the core requirement for ensuring the safe exchange of data between different application domain networks. Traditional cross-domain transmission mainly relies on physical isolation gateways, multi-level encryption gateways and zero-trust architecture, and its core principles revolve around physical / logical isolation, strong encryption algorithms (such as AES-256, SM4), multi-factor authentication and compliance auditing. However, the existing technology has the following key defects:

[0003] First, the traditional scheme is dominated by one-way transmission. Most traditional devices only support one-way transmission, and physical devices (such as optical isolation devices and optical one-way transmission devices) rely on specialized hardware to achieve one-way data flow, completely blocking the reverse channel through physical or logical isolation, thereby ensuring the "absolute security" of cross-domain data transmission.

[0004] Second, physical isolation devices are costly and lack scalability. The reliance on specialized hardware (such as optical couplers and customized chips) and intermediate media (U disks and disk arrays) makes the cost of device procurement and maintenance high. Their fixed parameters (such as bandwidth and storage capacity) are difficult to dynamically adapt to business traffic fluctuations, which can easily cause data congestion during peak periods and waste resources during low periods, severely limiting operational flexibility.

[0005] Third, the protocol compatibility and automation level are insufficient. Traditional systems mainly support basic file transfer protocols (such as FTP and SCP), and lack deep parsing capabilities for modern application layer protocols such as HTTP and TCP. Cross-protocol data transmission requires manual unloading and recovery, forcing business systems to undergo deep interface modifications, significantly increasing development and maintenance costs.

[0006] Fourth, the data transmission audit efficiency between different application domains or different security levels is significantly low. Due to the high security risk of data backhaul, traditional solutions mainly rely on manual audit mechanisms, significantly increasing the risk of business process blockage. Manual audits are easily influenced by subjective factors and have the risk of missing or misjudging, making it difficult to effectively balance the needs of security and efficiency.

[0007] In the prior art, the invention patent CN116932454B discloses a data transmission method, device, electronic equipment and computer readable storage medium, which is applied to a multi-domain system on chip (SOC). The method comprises the following steps: receiving a first transmission instruction of first communication data from a first domain to a second domain; the multi-domain system on chip (SOC) comprises the first domain and the second domain; writing the first communication data into a shared memory of the multi-domain system on chip (SOC) according to a virtual network interface of the first domain; starting a high-precision timer of the second domain; polling and reading the first communication data written into the shared memory according to the high-precision timer of the second domain; and transmitting the polled and read first communication data to the second domain according to a virtual network interface of the second domain. Thus, the network communication between domains can be efficiently performed under the condition that the multi-domain system on chip (SOC) lacks an internal Ethernet module (IP), and the load of the CPU is reduced. However, the method has the following defects:

[0008] (1) Physical cross-domain isolation cost: Although the shared memory reduces the hardware cost, the address space is crossed (such as memory out-of-bounds access vulnerability), and a memory management unit (MMU) needs to be additionally added for protection, which increases the system complexity.

[0009] (2) Low hardware storage efficiency: Frequent cross-domain transmission easily produces discontinuous memory fragments, affecting the transmission performance of large data such as video frames, and the copied data needs to undergo three copies of domain internal cache->shared memory->domain internal cache, increasing the memory bandwidth consumption.

[0010] (3) Two-way transmission limitation: When cross-encryption level data is returned, the security rules need to be manually pre-configured, and the differential data cannot automatically trigger the return mechanism; if the return is performed through a ring buffer mechanism, the data may be modified in the second domain and may lack verification logic, which may cause a risk of information leakage. SUMMARY

[0011] In view of the defects of the traditional cross-domain transmission system, such as single transmission direction, high isolation cost, poor protocol compatibility, manual approval for two-way transmission, and limited scalability, the present application provides a cross-domain two-way data transmission method, device and storage medium, which realizes cross-domain two-way data transmission based on multi-network card software and hardware cooperation and distributed storage, and can realize two-way transmission of data between different application domains and different encryption levels in a cross-domain scenario, multi-level security isolation and protocol conversion.

[0012] The technical solution adopted by the present application is as follows:

[0013] A cross-domain two-way data transmission method comprises the following steps:

[0014] A logical isolation channel between the source domain and the target domain is established by a multi-network card deployment, and shared storage permissions and transmission strategies are initialized; the logical isolation channel includes a first transmission channel and a second transmission channel;

[0015] The source domain standardizes and encapsulates data to generate standardized data and metadata, and transmits the standardized data and metadata to the target domain through the first transmission channel in a unidirectional manner;

[0016] The target domain restores the original protocol flow based on the standardized data and metadata transmitted by the source domain, and performs cross-domain business operations;

[0017] The target domain generates return data and performs verification, and after verification, the return data is returned to the source domain in a unidirectional manner through the second transmission channel. The source domain restores the return data.

[0018] Further, the logical isolation channel between the source domain and the target domain is established by a multi-network card deployment, and shared storage permissions and transmission strategies are initialized, including:

[0019] Hardware deployment and logical isolation: a plurality of independent physical network cards are deployed on the source domain server, and the MAC addresses are bound through BIOS-level firmware to ensure logical isolation;

[0020] Storage cluster initialization: a containerized data storage system is deployed on the source domain and the target domain respectively, and the data is stored on a distributed storage cluster; the source domain storage is configured with a "read-write" strategy, and the target domain storage is configured with a "read-only" strategy, and a permission mapping table is established between the storages to record the data flow.

[0021] Further, in the hardware deployment and logical isolation, the independent physical network cards deployed on the source domain server include a first independent network card and a second independent network card; the first independent network card is connected to the source domain network and is used for reading and writing data of the source domain; and the second independent network card is connected to the target domain network and is used for unidirectional transmission of data from the source domain to the target domain.

[0022] Further, the source domain standardizes and encapsulates data to generate standardized data and metadata, and transmits the standardized data and metadata to the target domain through the first transmission channel in a unidirectional manner, including:

[0023] Format conversion and label generation: the protocol proxy layer is converted into a standardized JSON file format in real time, and cross-domain metadata labels are attached;

[0024] Data collection and standardization: the source domain generates double hash fingerprints for data including files and protocols, and stores the double hash fingerprints in a metadata table. The original data and the metadata table are written into the source domain storage system through the first independent network card deployed on the source domain;

[0025] Secure transmission and isolation control: data is transmitted from the second independent network card deployed in the source domain to the third independent network card deployed in the target domain, and is written to the target domain storage system; the target domain storage system mounts the data to the target domain distributed storage cluster, and checks the consistency of the double hash fingerprints and the metadata table during transmission.

[0026] Further, the target domain restores the original protocol stream based on the standardized data and metadata transmitted by the source domain, and performs cross-domain business operations, including:

[0027] Metadata analysis and fingerprint verification: the target domain reads the metadata file in standardized JSON format from the storage, extracts the protocol type, security level, and double hash fingerprint; calculates the double hash fingerprint of the data body stored in the target domain, and compares it with the double hash fingerprint in the metadata to ensure data integrity;

[0028] Protocol stream restoration: according to the protocol name field in the metadata, select the corresponding protocol restoration rule, parse the protocol and restore the standardized JSON file to the original protocol format;

[0029] Business system interfacing and execution: deliver the restored protocol stream to the target domain business system through the standard interface, and the target domain business system executes the corresponding operation according to the restored protocol stream.

[0030] Further, the target domain restores the original protocol stream based on the standardized data and metadata transmitted by the source domain, and performs cross-domain business operations, further including:

[0031] Log auditing and exception handling: monitor the protocol restoration success rate, data delay, and target domain business system response status, and if the fingerprint comparison fails or the protocol restoration is abnormal, record error logs and assist with retry strategies.

[0032] Further, the target domain generates return data and performs verification, and after verification, returns to the source domain through a second transmission channel in one direction, and the source domain restores the return data, including:

[0033] Return channel logic isolation: deploy several independent physical network cards in the target domain for data return, and bind the MAC address through BIOS-level firmware to ensure isolation;

[0034] Intelligent verification of return data: containerized deployment of data storage systems is used in the source domain and the target domain, the data fingerprint returned by the target domain is matched with the corresponding metadata table and fingerprint in the distributed cluster, and if the matching is successful, no approval is required; otherwise, enter the intelligent decision-making process and perform hierarchical processing combined with AI risk assessment;

[0035] Backhaul data protocol restoration: After the file and protocol data are transferred to the source domain, the data is stored in the source domain's distributed storage cluster. The protocol is parsed and the standardized JSON file is restored to the original protocol format. The restored data and protocol are then made available for use by the source domain's business.

[0036] Furthermore, in the logical isolation of the return channel, the independent physical network cards deployed in the target domain include a fourth independent network card and a fifth independent network card. The fourth independent network card is connected to the target domain distributed storage cluster for data verification, and the fifth independent network card is connected to the source domain for one-way data copying.

[0037] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the cross-domain bidirectional data transmission method when executing the computer program.

[0038] A computer-readable storage medium stores a computer program, which implements the cross-domain bidirectional data transmission method when executed by a processor.

[0039] The beneficial effects of the present invention are:

[0040] 1. Cross-domain isolation architecture based on multiple network cards and shared storage

[0041] The present invention achieves physical layer isolation through a dual network card hardware architecture. Bidirectional data transmission between the source domain and the target domain uses an independent network card. The network card binds the MAC address through the BIOS-level firmware to ensure hardware-level isolation, so that data can be securely communicated between networks in different application domains. Only ordinary servers and standard network cards are required, and no dedicated routing equipment or special hardware is required. Secondly, based on shared storage, logical isolation of business data at the sending and receiving ends is achieved, and high data availability and elastic expansion are supported through distributed storage clusters. Dynamic expansion and load balancing of business traffic are achieved in combination with containerized deployment technology.

[0042] 2. Scalable and customizable multi-level security isolation mechanism

[0043] This invention implements multi-level isolation for data storage systems and data security at the software level. First, process-level isolation strictly isolates the data receiving process from the data forwarding process, supporting container namespace isolation technology, virtual machine operating system kernel isolation, or physical hardware-level isolation. Second, storage-layer security isolation achieves end-to-end data flow control through file system-level permission control, access restrictions on dedicated storage controllers, and storage space permission mapping (directional read and write policies between storage). Finally, protocol-level isolation embeds confidentiality tags in the standardized JSON encapsulation process to ensure that the protocol conversion and restoration processes comply with security policies. Multi-level isolation mechanisms can be combined and configured as needed, taking into account both security and flexibility requirements.

[0044] 3. High-reliability data transmission mechanism from source domain to target domain

[0045] Before data is transmitted from the source domain to the target domain, metadata is automatically recorded and double hash fingerprints (MD5 + SHA-256) are generated. After transmission to the target domain through the dual network card, the target end performs full-process verification (collection, storage, transmission, and analysis node verification) on the fingerprints to ensure data integrity. Data with failed fingerprint comparison will be marked and recorded in the audit log and tracked for abnormalities, improving the credibility and traceability of data interaction.

[0046] 4. Automated secure backhaul solution from target domain to source domain

[0047] Before data is transmitted from the target domain to the source domain, double hash fingerprint verification is performed first. If the fingerprints match, the data is automatically released. If the fingerprints do not match, intelligent grading processing is triggered: low-risk data is automatically desensitized or formatted by an AI model risk assessment and then released; high-risk data enters a review process. This mechanism improves the transmission efficiency of cross-domain data backhaul through automated approval, while multi-layer encryption and access control strategies ensure the compliance of backhaul data, balancing the demand for security and efficiency.

[0048] 5. Standardized conversion and zero-reconstruction interfacing of bidirectional protocol

[0049] During transmission, the source domain protocol proxy layer converts raw protocols such as HTTP and TCP into standardized JSON format, and the target domain analysis engine automatically restores the original protocol stream (such as HTTP request parameters and TCP session state). Through the entire process of protocol "unloading, conversion, and reconstruction", seamless interfacing of cross-protocol business systems is achieved without modifying the original business interface, reducing system reconstruction costs and operational complexity.

[0050] In summary, the present invention proposes a high-reliability, high-security, and automated cross-domain bidirectional data transmission solution for cross-domain data transmission through multiple innovations such as multiple network cards, shared storage, software and hardware collaboration, intelligent verification, and protocol standardization. This solution effectively overcomes the problems of traditional solutions such as unidirectionality, high cost, poor protocol compatibility, and human dependence. The present invention realizes bidirectional safe and controllable transmission of cross-domain data, zero-reconstruction interfacing of business systems, automated risk assessment, and high reliability, reducing human intervention in cross-application domain and cross-classification data backhaul while improving security, achieving efficient and low-cost cross-domain business collaboration. BRIEF DESCRIPTION OF DRAWINGS

[0051] Figure 1 is a cross-domain bidirectional data transmission method flowchart of embodiment 1 of the present invention.

[0052] Figure 2 is a cross-domain bidirectional data transmission method flowchart of embodiment 2 of the present invention.

[0053] Figure 3 is a target domain to source domain data backhaul flowchart of embodiment 2 of the present application. DETAILED DESCRIPTION

[0054] In order to have a clearer understanding of the technical features, objectives and effects of the present application, the specific embodiments of the present application will now be described. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application, i.e., the described embodiments are only a part of the embodiments of the present application, but not all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the present application.

[0055] Embodiment 1

[0056] As shown in the following table, the present embodiment provides a cross-domain bidirectional data transmission method, which comprises: Figure 1

[0057] A logical isolation channel between the source domain and the target domain is established by multi-network card deployment, and the shared storage permission and the transmission strategy are initialized; wherein the logical isolation channel comprises a first transmission channel and a second transmission channel;

[0058] The source domain standardizes and encapsulates data to generate standardized data and metadata, and transmits the standardized data and metadata to the target domain through the first transmission channel in a unidirectional manner;

[0059] The target domain restores the original protocol stream based on the standardized data and metadata transmitted by the source domain, and performs cross-domain business operations;

[0060] The target domain generates backhaul data and performs verification, and after verification, the backhaul data is transmitted to the source domain in a unidirectional manner through the second transmission channel, and the source domain restores the backhaul data.

[0061] Preferably, the cross-domain bidirectional data transmission method of the present embodiment can be implemented by the following steps:

[0062] S10: initialize multi-network card deployment and storage, establish a logically isolated dual-domain connection channel, and initialize shared storage permissions and transmission strategies.

[0063] More preferably, the present step can be implemented by the following sub-steps:

[0064] S101: hardware deployment and logical isolation. Two independent physical network cards (source domain network card / target domain network card) are deployed on the source domain server, and the MAC address is bound through BIOS-level firmware to ensure logical isolation. Among them, the source domain network card is connected to the source domain network and is used for reading and writing data in the source domain; the target domain network card is connected to the target domain network and is only used for unidirectional data transmission from the source domain to the target domain.

[0065] ​S102: Storage cluster initialization. In the source domain and the target domain, containerized deployment of the data storage system is used, and the data is stored on the distributed storage cluster respectively; the source domain storage is configured with a "read-write" strategy, and the target domain storage is configured with a "read-only" strategy, and a permission mapping table is established between the storages to record the data flow.

[0066] S20: Protocol data standardization and encapsulation, secure transmission of data from the source domain to the target domain, and ensuring reverse irreversibility.

[0067] More preferably, this step can be implemented using the following sub-steps:

[0068] S201: Real-time conversion of the protocol agent layer to a standardized JSON file format, with the addition of cross-domain metadata tags, such as:

[0069] {

[0070] "protocol_type": <protocol name>

[0071] "source_bucket": <source domain data bucket>

[0072] "target_bucket": <target domain data bucket>

[0073] "security_level": <security level>

[0074] "fingerprint": {#double hash fingerprint

[0075] "MD5": <irreversible digest algorithm>

[0076] "SHA-256": <security hash algorithm>

[0077] }

[0078] }

[0079] S202: Data collection and standardization. The source domain generates a double hash fingerprint (MD5 + SHA-256) for files and protocol data, stores it in the metadata table, and writes the original data and metadata table to the source domain storage system through the source domain network card.

[0080] S203: Secure transmission and isolation control. The read-only target domain network card copies the data to another target domain network card, writes the data to the target domain storage system, and mounts the system data to the target domain distributed storage cluster. The consistency of the fingerprint and the metadata table is checked during transmission.

[0081] S30: The target domain restores the original protocol stream based on the standardized data and metadata generated in step S20, and completes the cross-domain business operation.

[0082] More preferably, the present step can be implemented by the following sub-steps:

[0083] S301: Metadata parsing and fingerprint verification. The target domain reads the standardized JSON metadata file from storage, extracts the protocol type, security level, and double hash fingerprint; calculates the MD5 and SHA-256 hash values of the data body stored in the target domain, and compares them with the fingerprints in the metadata to ensure data integrity.

[0084] S302: Protocol flow restoration. According to the protocol name field in the metadata, select the corresponding protocol restoration rule (such as HTTP / TCP / Custom protocol), parse the protocol and restore the standardized JSON file to the original protocol format.

[0085] S303: Business system interfacing and execution. Deliver the restored protocol flow to the target domain business system through a standard interface (such as REST API, message queue), and the target domain system executes the corresponding operation (such as database writing, API calling, file storage) according to the restored protocol flow.

[0086] S304: Log auditing and exception handling. Monitor the protocol restoration success rate, data delay, and business system response status, and if the fingerprint comparison fails or the protocol restoration is abnormal, record error logs and assist with retry strategies.

[0087] S40: Cross-domain data back transmission and intelligent approval, realizing safe back transmission from the target domain to the source domain, supplemented by automated decision-making to reduce manual intervention.

[0088] More preferably, the present step can be implemented by the following sub-steps:

[0089] S401: Back transmission channel logic isolation. Use another set of dual-network card hardware devices for data back transmission, and use BIOS-level firmware to bind MAC addresses to ensure isolation. Specifically, use another target domain network card to connect the target domain distributed storage cluster for data verification, and another source domain network card to connect the source domain for one-way data copying.

[0090] S402: Intelligent verification of back transmission data. Use containerized deployment of data storage systems in the source domain and the target domain, respectively, and the target domain back transmission data fingerprint matches the corresponding metadata table and fingerprint in the distributed cluster, and if the verification is successful, no approval is required, and if it does not match, it enters the intelligent decision-making process and combines AI risk assessment for hierarchical processing.

[0091] S403: Back transmission data protocol restoration. After the file and protocol data are transmitted to the source domain, store the data in the distributed storage cluster of the source domain; parse the protocol and restore the standardized JSON file to the original protocol format, and restore the data and protocol for use by the source domain business.

[0092] In summary, the cross-domain bidirectional data transmission method of the embodiment has the following characteristics:

[0093] First, the multi-network card software and hardware collaborative architecture design. A general server is used to carry multiple network cards, and the network boundary of different application domains and different security level networks is hard partitioned through logical isolation. The double network cards are connected to the target domain and the source domain respectively, replacing the traditional special isolation device, and significantly reducing the hardware cost. The software layer is based on containerization and virtualization isolation, and the data layer uses a distributed shared storage cluster to provide high-availability storage support, solving the scalability bottleneck of the fixed parameters of traditional devices.

[0094] Second, the bidirectional transmission security software architecture. By deploying a bidirectional isolation agent and a content fingerprint verification mechanism, secure transmission is achieved while maintaining logical isolation of different application domains; the middleware integrates multiple algorithms to compare and transmit file fingerprints in real time, and automatically releases them upon successful matching, or triggers an AI-based intelligent approval process upon mismatch. All transmission record operation logs are uploaded to the audit system to ensure traceability throughout the process, improving transmission efficiency and reducing human approval burden, and meeting the needs of bidirectional data flow in high-security scenarios.

[0095] Third, protocol automatic analysis and recovery. A lightweight protocol analysis engine is deployed to support transparent conversion of HTTP, TCP, and other protocols. The source protocol data is standardized and encapsulated (converted to JSON format middleware files), and the original protocol stream is restored through an intelligent analysis engine, supporting zero-reconstruction connection of business systems.

[0096] Embodiment 2

[0097] Based on Embodiment 1, the embodiment provides a cross-domain bidirectional data transmission method, which includes the following steps:

[0098] As shown in Figure 2 , the embodiment provides a cross-domain bidirectional data transmission method, which includes the following steps:

[0099] Stage S10: Hardware deployment and initialization.

[0100] S101: Logical isolation configuration. The source domain server is deployed with two independent network cards (network card 1: 00:1A:2B:3C:4D:5E binds the source domain IP 192.168.1.100; network card 2: 00:1A:2B:3C:4D:5F binds the target domain IP 10.0.0.200), and the network card MAC address is locked by BIOS firmware to ensure physical layer isolation.

[0101] S102: Storage cluster initialization. Source domain data storage system 1 is deployed in the source domain, and data is stored in the source domain distributed storage cluster 1; target domain data storage system 2 is deployed in the target domain, and data is stored in the target domain distributed storage cluster 2.

[0102] Configure the bucket policy: source domain storage bucket low_sec_bucket (read-write policy), target domain storage bucket high_sec_bucket (read-only policy), and the permission mapping table records low_sec_bucket → high_sec_bucket (one-way transmission channel).

[0103] Stage S20: Source domain data packaging and transmission.

[0104] S201: Protocol proxy layer standardization conversion. The protocol proxy layer is converted into a standardized JSON file format in real time, with the addition of cross-domain metadata tags.

[0105] S202: Data collection and transmission. Write the original data and metadata to the source domain storage bucket low_sec_bucket / data_001; one-way copy to the target domain storage bucket high_sec_bucket / data_001 through network card 2, and verify the fingerprint match during transmission.

[0106] Stage S30: Target domain data restoration and execution.

[0107] S301: Fingerprint verification. The target domain reads the metadata and calculates the target data body hash value; verification is passed, allowing subsequent operations.

[0108] S302: Protocol restoration. According to the protocol name field in the metadata, parse the JSON metadata and restore the original HTTP request data stream.

[0109] S303: Business interface. Submit the restored HTTP request to the target domain database system through the REST API, complete identity authentication and data writing.

[0110] S304: Log audit. Record and audit successful logs.

[0111] Stage S40: Target domain feedback, as shown in Figure 3 .

[0112] S401: Logical isolation configuration. The target domain server deploys two independent network cards (network card 4: 00:1A:2B:3C:4D:5G binds the source domain IP 10.0.0.201; network card 5: 00:1A:2B:3C:4D:5H binds the target domain IP 192.168.1.101), BIOS firmware locks the network card MAC address, ensuring physical layer isolation.

[0113] S402: Intelligent verification. The data performs double-fingerprint verification on the original data in network card 4 and the feedback data in network card 3, and after fingerprint matching or intelligent decision-making or manual approval, it is one-way transmitted to the source domain through network card 5.

[0114] S403: protocol restoration. After the source domain network card 6 receives the data, the data is stored in the source domain distributed storage cluster 1, the JSON data is parsed, the file data is restored, and the data is directly returned to the business system for use, and the data restoration and the log of using the data by the business are recorded for auditing.

[0115] Embodiment 3

[0116] This embodiment is based on embodiment 1:

[0117] This embodiment provides a computer device, which includes a memory and a processor, the memory stores a computer program, and the processor implements the cross-domain bidirectional data transmission method of embodiment 1 when executing the computer program. The computer program can be in the form of source code, object code, executable file or some intermediate form, etc.

[0118] Embodiment 4

[0119] This embodiment is based on embodiment 1:

[0120] This embodiment provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the cross-domain bidirectional data transmission method of embodiment 1. The computer program can be in the form of source code, object code, executable file or some intermediate form, etc. The storage medium includes any entity or device capable of carrying computer program code, recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content included in the storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the storage medium does not include electrical carrier signals and telecommunication signals.

[0121] It should be noted that, for the foregoing method embodiments, in order to simplify the description, they are expressed as a combination of a series of actions, but those skilled in the art should know that the present application is not limited to the order of the actions described, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

Claims

1. A cross-domain bidirectional data transmission method, characterized in that: include: Establish a logical isolation channel between the source and target domains through multi-NIC deployment, and initialize shared storage permissions and transmission policies; The logical isolation channel includes a first transmission channel and a second transmission channel; The source domain performs standardized encapsulation on the data, generates standardized data and metadata, and transmits them unidirectionally to the target domain through the first transmission channel; The target domain restores the original protocol flow based on the standardized data and metadata transmitted by the source domain and performs cross-domain business operations. The target domain generates and verifies the returned data, which is then transmitted back to the source domain via a second transmission channel. The source domain then restores the returned data. The process of establishing a logical isolation channel between the source domain and the target domain through multi-NIC deployment and initializing shared storage permissions and transmission policies includes: Hardware deployment and logical isolation: Deploy several independent physical network cards on the source domain server and bind MAC addresses through BIOS-level firmware to ensure logical isolation. Storage cluster initialization: Use containerized data storage systems in both the source and target domains, storing data in distributed storage clusters. Configure a "read-write" policy for the source domain storage and a "read-only" policy for the target domain storage. Establish a permission mapping table between storage systems to record data flows. The source domain performs standardized encapsulation on the data to generate standardized data and metadata, and transmits the standardized data and metadata to the target domain in a unidirectional manner through the first transmission channel, including: Format conversion and tag generation: convert the protocol proxy layer into a standardized JSON file format in real time and attach cross-domain metadata tags; Data collection and standardization: The source domain generates double hash fingerprints for data, including files and protocols, and stores them in a metadata table. The original data and metadata table are then written to the source domain storage system through the first independent network interface card deployed in the source domain. Secure transmission and isolation control: Data is transmitted via a second independent network card deployed in the source domain to a third independent network card deployed in the target domain, and then written to the target domain storage system. The target domain storage system then mounts the data to the target domain distributed storage cluster, verifying the consistency of the double hash fingerprint and metadata table during transmission. The target domain generates and verifies the returned data, and after verification, transmits the data back to the source domain in one direction through the second transmission channel. The source domain then restores the returned data, including: Logical isolation of the backhaul channel: Deploy several independent physical network cards in the target domain for data backhaul, and ensure isolation by binding MAC addresses through BIOS-level firmware. Intelligent verification of returned data: Containerized data storage systems are deployed in both the source and target domains. The data fingerprints returned by the target domain are matched with the corresponding metadata tables and fingerprints in the distributed cluster. If a match is successful, no approval is required. Otherwise, the data enters the intelligent decision-making process and is graded based on AI risk assessment. Backhaul data protocol restoration: After the file and protocol data are transferred to the source domain, the data is stored in the source domain's distributed storage cluster. The protocol is parsed and the standardized JSON file is restored to the original protocol format. The restored data and protocol are then made available for use by the source domain's business.

2. A cross-domain bidirectional data transmission method according to claim 1, characterized in that: In the hardware deployment and logical isolation, the independent physical network cards deployed on the source domain server include a first independent network card and a second independent network card; the first independent network card is connected to the source domain network and is used for reading and writing source domain data; the second independent network card is connected to the target domain network and is used for unidirectional transmission of data from the source domain to the target domain.

3. The cross-domain bidirectional data transmission method according to claim 1, characterized in that: The target domain restores the original protocol stream based on the standardized data and metadata transmitted by the source domain and performs cross-domain business operations, including: Metadata parsing and fingerprint verification: The target domain reads the metadata file in standardized JSON format from the storage, extracts the protocol type, security level, and double hash fingerprint; calculates the double hash fingerprint of the data stored in the target domain and compares it with the double hash fingerprint in the metadata to ensure data integrity; Protocol flow restoration: Based on the protocol name field in the metadata, select the corresponding protocol restoration rule, parse the protocol, and restore the standardized JSON file to the original protocol format; Business system docking and execution: The restored protocol flow is delivered to the target domain business system through the standard interface, and the target domain business system performs corresponding operations based on the restored protocol flow.

4. A cross-domain bidirectional data transmission method according to claim 3, characterized in that: The target domain restores the original protocol flow based on the standardized data and metadata transmitted by the source domain and performs cross-domain business operations, further comprising: Log auditing and exception handling: Monitor the success rate of protocol restoration, data latency, and the response status of the target domain business system. If fingerprint matching fails or protocol restoration is abnormal, record the error log and implement a retry strategy.

5. The cross-domain bidirectional data transmission method according to claim 1, characterized in that: In the return channel logical isolation, the independent physical network cards deployed in the target domain include a fourth independent network card and a fifth independent network card. The fourth independent network card is connected to the target domain distributed storage cluster for data verification, and the fifth independent network card is connected to the source domain for unidirectional data copying.

6. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the cross-domain bidirectional data transmission method according to any one of claims 1 to 5 is implemented.

7. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the cross-domain bidirectional data transmission method according to any one of claims 1 to 5 is implemented.

Images