Private protocol transmission security management system and method based on one-way communication device

Abstract

The application discloses a private protocol transmission security management system and method based on a one-way communication device, and relates to the technical field of network security. The method comprises the following steps: extracting the communication characteristics of a private protocol and performing normalization processing, and constructing a private protocol feature library; deploying a protocol analysis engine on the low-security side of a one-way optical shutter, performing deep detection on the out-domain data stream, identifying the private protocol, and extracting the current session protocol characteristics; matching the extracted characteristics with the feature library, and performing compliance verification and content filtering according to a security policy after successful matching; the verified data is encapsulated into a transmission format allowed to pass through the one-way optical shutter, and is sent to the high-security side through the one-way optical shutter; the received data is reorganized, and integrity and consistency verification is performed on the high-security side, and after the verification is passed, an audit log is recorded and forwarded to a target system; the protocol behavior and the session state are monitored in real time, and a security alarm is triggered and the transmission is blocked for unknown protocols or abnormal behaviors.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a proprietary protocol transmission security management system and method based on a one-way communication device. Background Technology

[0002] In highly sensitive network environments, physical isolation is a key means of ensuring the security of core data. One-way optical gates, as the core device for achieving physical isolation, ensure through their physical characteristics that data can only flow unidirectionally from low-security domains to high-security domains, thus blocking reverse network attack paths at the fundamental level.

[0003] However, existing unidirectional optical shutter products have significant security blind spots. Most of them only verify the underlying data format, acting like "dumb pipes," allowing data to pass as long as the format is compliant. This mechanism cannot perform deep data content analysis, allowing application-layer attacks hidden under compliant protocols to easily penetrate the isolation barrier and pose a serious threat.

[0004] Therefore, current technology cannot achieve fine-grained analysis and security control of transmitted content while ensuring physical unidirectionality. This deficiency has become a prominent pain point in high-security network environments, urgently requiring an innovative technical solution to address this critical technical problem. Summary of the Invention

[0005] The purpose of this invention is to provide a secure management system and method for private protocol transmission based on a one-way communication device, so as to solve the problems raised in the prior art.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a method for secure management of private protocol transmission based on a one-way communication device, the method comprising:

[0007] S1. Extract the communication features of the private protocol, normalize the communication features, and store them in the private protocol feature library;

[0008] S2. Deploy a protocol parsing engine on the low-security side of the unidirectional optical gate to perform deep inspection of outbound data streams and determine whether the data stream belongs to a private protocol; if it is identified as a private protocol, extract the protocol features of the current session.

[0009] S3. Match the extracted protocol features with the private protocol feature library; if the match is successful, perform compliance verification and content filtering on the data content according to the preset security policy; if the match fails, determine it as an unknown protocol and proceed to S6 for processing.

[0010] S4. Encapsulate the data that has passed the compliance verification into a transmission format that allows it to pass through the one-way optical gate, and send it to the high-security side through the one-way optical gate;

[0011] S5. On the high-security side, the received data is reassembled and its integrity and consistency are verified; after the verification is passed, an audit log is recorded and forwarded to the target system;

[0012] S6. Monitor protocol behavior and session status in real time. If an unknown protocol, abnormal protocol characteristics, or session behavior deviates from the preset mode is detected, a security alarm will be triggered and the current transmission link will be blocked.

[0013] Furthermore, S1 includes:

[0014] The communication features include protocol header structure, payload structure, instruction set, and session behavior pattern;

[0015] Collect the header data included in the private protocol sample, denoted as H. i =(h i1 ,h i2 ,…,h ik ), where i = 1, 2, ..., N; k is the number of header fields; h i1 ,h i2 ,…,h ik These represent the values ​​of the 1st, 2nd, and kth header fields of the i-th private protocol sample, respectively.

[0016] Extract the feature parameters of each header field, including the field length L. ij Range of values ​​R ij =[min(h ij ),max(h ij Field type T ij ;

[0017] The above-mentioned field types include representation fields, length fields, and validation fields;

[0018] Payload data P for each private protocol sample i =(p i1 ,p i2 ,…,p im The parsing is performed, where m is the number of payload fields; p i1 ,p i2 ,…,p im These represent the values ​​of the 1st, 2nd, and mth payload fields of the i-th private protocol sample, respectively; the delimiter D of the payload field is obtained. i And extract the length M of each load field. ij Data type S ij Field meaning description Cij ;

[0019] The delimiters mentioned above include specific byte sequences, length identifiers, etc., and data types include integers, strings, binary streams, etc.

[0020] Identify the instruction code I in each private protocol sample i =(i i1 i i2 ,…i in ), where n is the number of instructions, i i1 i i2 ,…i in These represent the 1st, 2nd, and mth instruction codes of the i-th private protocol sample, respectively; record the functional description F corresponding to each instruction code. ij Number of instruction parameters Q ij Parameter format G ij Execution response format H ij ;

[0021] Collect session interaction data from each private protocol sample, including the establishment request R i1 Response R i2 Data transmission sequence, session close request C i1 Response C i2 ;

[0022] Extract session behavior features, including session establishment time T. is Session duration T id Data transmission rate V i Number of session interactions N i ;

[0023] The above-mentioned session duration T id =T ie -T is Data transmission rate Among them, T ie D is the session close time. T The total number of sessions transmitted;

[0024] The collected data is normalized.

[0025] The above normalization process includes:

[0026] For field length L ij M ij Session duration T id Data transmission rate V i For numerical features, the min-max normalization method is used, as shown in the following formula:

[0027] ;

[0028] Where X is the original feature value, X min X is the minimum value of this feature among all samples. maxX is the maximum value of this feature across all samples. norm These are the normalized eigenvalues;

[0029] For field type T ij Data type S ij Instruction Function Description F ij Equal-type features are processed using one-hot encoding; for example, if there are K types of fields, each type of field is represented as a K-dimensional vector, where the corresponding type position is 1 and the rest are 0.

[0030] For the delimiter D i Instruction code I i Strings of different lengths are converted into ASCII codes or hexadecimal numerical sequences and then standardized to ensure that strings of different lengths have a uniform representation.

[0031] The normalized communication features are classified and stored according to protocol categories to build a private protocol feature library.

[0032] Furthermore, S2 includes:

[0033] A data acquisition unit is deployed on the low-security side of the unidirectional optical shutter to collect outbound data streams from the low-security side to the high-security side in real time. The collected data streams are in data packets as the basic unit, and each data packet contains header information and data payload.

[0034] The packet header information mentioned above includes, but is not limited to, source IP address, destination IP address, source port number, destination port number, protocol type, etc.

[0035] Preprocess the collected data packets;

[0036] The above preprocessing process includes:

[0037] The collected data packets are deduplicated to remove duplicate data packets and avoid duplicate detection; a hash algorithm is used to calculate the hash value of each data packet. If two data packets have the same hash value, they are determined to be duplicate data packets, and only one is kept for subsequent processing.

[0038] Data packets are fragmented and reassembled. If a data packet is transmitted in fragments, the fragmented data is reassembled into a complete data packet according to the relevant rules of IP fragmentation.

[0039] Extract the header data of the data packet and compare it with the header structure features of each protocol in the private protocol feature library; calculate the matching degree M of the header fields. h The formula is as follows:

[0040] ;

[0041] Among them, hj H represents the value of the j-th header field of the data packet to be detected. ij Let j be the range of values ​​for the j-th header field of the i-th protocol in the private protocol feature library. For indicator functions, if ,but ,otherwise , The weight of the j-th header field;

[0042] The above The weighting is set according to the importance of the fields, such as higher weighting for identifier fields and lower weighting for validation fields;

[0043] If a certain protocol i makes M h ≥θ h If so, the data packet is preliminarily determined to belong to protocol i;

[0044] The above θ h This is the threshold for head matching, set according to the actual situation.

[0045] For data packets initially determined to belong to protocol i, extract the packet payload data and parse it according to the payload format characteristics of protocol i; check whether the delimiter of the payload field matches D. i Consistency: Do the field lengths and data types of each load field conform to M? ij and S ij Requirements;

[0046] Calculate the matching degree M of the load format p The formula is as follows:

[0047] ;

[0048] Where, p j For the characteristics of the j-th payload field of the data packet to be detected, P ij For the feature requirements of the j-th payload field of the i-th protocol in the private protocol feature library, Let p be an indicator function. j Conforms to P ij The requirements are as follows: ,otherwise v j The weight of the j-th load field;

[0049] If M p ≥θ p Then it is further determined that the data packet to be detected belongs to protocol i; where θ p The load matching threshold should be set according to the actual situation.

[0050] Extract the instruction code from the payload data, and match it with the instruction set I of protocol i. iPerform a comparison; check if the instruction code is in instruction set I. i The question arises: do the number and format of the instruction parameters conform to the requirements of the corresponding instruction? ij and G ij ;

[0051] Calculate the matching degree M of the instruction set i The formula is as follows:

[0052] ;

[0053] Among them, i j For the instruction codes and parameter characteristics in the data packet to be detected, I ij For the feature requirements of the i-th protocol and j-th instruction in the private protocol feature library, Let be an indicator function; if ij satisfies the requirement of Iij, then ,otherwise u j Let be the weight of the j-th instruction;

[0054] If M i ≥θ i If the data packet to be detected is determined to belong to protocol i, it is identified as a private protocol; where θ i The instruction matching threshold should be set according to the actual situation.

[0055] For data streams identified as private protocols, the session process corresponding to the data stream is tracked, and the protocol features of the current session are extracted, including the session header structure features, payload format features, instruction set features, and session behavior pattern features. The extracted features are stored as a feature vector F=(f1,f2,…,ft), where t is the feature dimension.

[0056] The aforementioned header structure features include, but are not limited to, dynamically changing identifier fields and length fields; payload format features include, but are not limited to, field content transmitted in real time and data type changes; instruction set features include, but are not limited to, instruction sequences and parameter values ​​used during the session; and session behavior pattern features include, but are not limited to, session establishment time, data transmission rate changes, and number of interactions.

[0057] Furthermore, S3 includes:

[0058] The extracted current session protocol feature vector F is compared with the feature vectors F of each protocol in the private protocol feature library. k =(f k1 ,f k2 ,…,f kt Similarity calculation is performed using the cosine similarity algorithm, with the following formula:

[0059] ;

[0060] Among them, f l f is the l-th feature value of the current session feature vector F. kl F is the k-th protocol feature vector in the private protocol feature library. k The l-th eigenvalue, Sim(F,F) k ) represents the cosine similarity between two feature vectors, with a value range of [0,1]. The closer the value is to 1, the higher the similarity.

[0061] Pre-set similarity threshold θ s If Sim(F,F) k )≥θ s If the current session protocol matches protocol k in the private protocol feature library, then the current session protocol is determined to be a successful match; if the Sim(F,F) of all protocols k are... k )<θ s If the match fails, the current session protocol is an unknown protocol, and the process is transferred to S6 for handling.

[0062] For successfully matched session protocols, the data content is subjected to compliance verification according to a preset security policy; the compliance verification includes data content verification, instruction permission verification, and session behavior compliance verification.

[0063] The above verification process includes:

[0064] Data content validation: Check whether the data payload contains sensitive information (such as ID card number, bank card number, password, etc.); use regular expression matching, if the match is successful, it is determined that sensitive information is contained and the validation fails; check whether the data content meets the business rules requirements, such as data value range, format specifications, etc.; for example, for a field representing quantity, if its value exceeds the preset maximum allowed value or is less than the preset minimum allowed value, the validation fails.

[0065] Command permission verification: Based on the preset command permission list, check whether the commands used in the current session are within the allowed permission range; if a command is not in the permission list, or the current user / device does not have the execution permission for the command, the verification will fail.

[0066] Session behavior compliance verification: Checks whether the behavior pattern of the current session conforms to the preset normal pattern; for example, whether the session duration exceeds the preset maximum allowed duration, and whether the data transmission rate exceeds the preset maximum allowed rate. If they exceed the limits, the verification fails.

[0067] If the data content compliance verification fails, content filtering operations will be performed, including: sensitive information filtering, illegal instruction filtering, and abnormal behavior data filtering.

[0068] The above filtering process includes:

[0069] Sensitive information filtering: Data containing sensitive information is processed using data anonymization techniques;

[0070] Illegal command filtering: For data containing illegal commands, the data packet is discarded directly, and a filtering log is recorded. The log content includes the source IP address, destination IP address, command code, filtering time, etc. of the data packet.

[0071] Abnormal behavior data filtering: For data with abnormal session behavior, such as excessively high data transmission rate or excessively long session duration, according to the preset filtering policy, some data packets can be dropped or the current session can be interrupted, and relevant logs can be recorded.

[0072] Furthermore, S4 includes:

[0073] Define the transmission format that is allowed to pass through the unidirectional optical gate, including the package header, data payload, and package tail;

[0074] The above transmission format is defined as follows:

[0075] Encapsulation header: Includes fields such as version number, protocol identifier, data length, and checksum (used to verify the integrity of the encapsulation header);

[0076] Data payload: The original data after passing compliance verification;

[0077] The end of the encapsulation contains fields such as data integrity check code and encapsulation timestamp;

[0078] Calculate the CRC32 checksum of the original data. data , serving as a data integrity check code at the end of the encapsulation;

[0079] The XOR check algorithm is used to perform an XOR operation on the bytes of each field in the header to obtain the CRC checksum of the encapsulated header. header ;

[0080] The encapsulation header, original data, and encapsulation tail are combined in sequence to form the encapsulated data unit, Data.

[0081] Select the physical transmission link corresponding to the one-way optical shutter, and adopt a flow control mechanism to control the data transmission rate v based on the transmission bandwidth B of the one-way optical shutter and the network conditions, such that v ≤ B. The formula for calculating the data transmission rate v is:

[0082] ;

[0083] Where DataSize is the amount of data sent within the time interval T;

[0084] The data units to be sent are numbered and sent in numerical order to ensure that the data is not out of order during transmission.

[0085] Furthermore, S5 includes:

[0086] A data receiving unit is deployed on the high-security side to receive encapsulated data units (Data) transmitted from the unidirectional optical gate in real time.

[0087] Extract the encapsulation header of the data unit and calculate the checksum of the encapsulation header. and the CRC recorded in the header header Perform a comparison; if If the encapsulation head is damaged, the data unit is discarded; if Check whether the version number in the encapsulation header is consistent with the version number supported by the high-security side, whether the protocol identifier is within the preset allowable range, and whether the data length does not exceed the preset maximum data unit length. If there is an abnormality, discard the data unit.

[0088] Extract the end of the data unit's encapsulation to obtain the CRC checksum. data And recalculate the CRC32 checksum on the original data. ;like If the original data is corrupted during transmission, the data unit is discarded; if If so, then data restructuring will be performed;

[0089] Based on the data unit number, the received data units are sorted in ascending order of number; the data payload of each sorted data unit is extracted, and the data payloads are spliced ​​together in order to form a complete original data stream.

[0090] Calculate the hash value of the received original data stream and compare it with the hash value of the original data stream provided by the sender before data transmission; if the hash values ​​before and after reception are consistent, the reassembly is considered successful; otherwise, the reassembly is considered to have failed.

[0091] The reassembled and verified original data stream is forwarded to the target system.

[0092] Furthermore, to better implement the above method, a private protocol transmission security management system based on a one-way communication device is also provided. This private protocol transmission security management system includes: a protocol parsing module, a protocol matching and security verification module, a data encapsulation and transmission module, and a data receiving and reassembly module.

[0093] The protocol parsing module, deployed on the low-security side of the unidirectional optical shutter, is used to perform deep inspection of outbound data streams, identify private protocols, and extract protocol features of the current session.

[0094] The protocol parsing module includes: a data acquisition unit, a data preprocessing unit, a protocol recognition unit, and a feature extraction unit;

[0095] The data acquisition unit collects outbound data streams from the low-security side to the high-security side in real time, using data packets as the basic unit to obtain the packet header information and data payload.

[0096] The data preprocessing unit performs deduplication and fragmentation reassembly on the collected data packets. The deduplication process uses a hash algorithm to calculate the hash value of the data packets and remove duplicate data packets. The fragmentation reassembly reassembles the fragmented data into complete data packets according to IP fragmentation rules.

[0097] The protocol identification unit extracts the header data, payload data, and instruction code of the data packet, compares them with the private protocol feature library, calculates the header matching degree, payload matching degree, and instruction matching degree, and determines whether the data stream belongs to the private protocol by using a threshold.

[0098] The feature extraction unit, for data streams identified as having a private protocol, tracks the session process of the data stream, extracts the protocol features of the current session, including header structure features, payload format features, instruction set features, and session behavior pattern features, and stores them as feature vectors.

[0099] Furthermore, the protocol matching and security verification module includes: a feature matching unit, a compliance verification unit, and a content filtering unit;

[0100] The protocol matching and security verification module is used to match the extracted protocol features with a private protocol feature library and perform compliance verification and content filtering according to security policies.

[0101] The feature matching unit calculates the cosine similarity between the current session protocol feature vector and the feature vectors of each protocol in the private protocol feature library, and determines whether the match is successful by using a similarity threshold; if the match fails, it is marked as an unknown protocol and subsequent processing is triggered.

[0102] The compliance verification unit performs data content verification, command permission verification, and session behavior compliance verification on successfully matched session protocols. Among them, data content verification uses regular expressions to match sensitive information and checks the data value range and format specifications; command permission verification verifies the legality of commands through a preset command permission list; and session behavior compliance verification checks whether the session duration and data transmission rate exceed preset ranges.

[0103] The content filtering unit performs filtering operations on data that fails compliance verification, including using data anonymization technology to filter sensitive information, directly discarding data packets containing illegal instructions, discarding abnormal behavior data or terminating the session according to the filtering policy, and recording filtering logs.

[0104] Furthermore, the data encapsulation and transmission module includes: an encapsulation format definition unit, a checksum calculation unit, a flow control unit, and a data transmission unit;

[0105] The data encapsulation and transmission module is used to encapsulate the data that has passed the compliance verification into a transmission format that allows it to pass through the one-way optical gate, and then send it to the high-security side through the one-way optical gate.

[0106] The encapsulation format definition unit defines the transmission format that is allowed to pass through the unidirectional optical gate, including the encapsulation header, data payload, and encapsulation tail.

[0107] The check code calculation unit calculates the CRC32 check code of the original data as the data integrity check code, and uses the XOR check algorithm to calculate the check code of the encapsulation header.

[0108] The flow control unit controls the data transmission rate based on the transmission bandwidth of the one-way optical shutter and network conditions;

[0109] The data transmission unit numbers the encapsulated data units and transmits the data in numerical order through the physical transmission link of the unidirectional optical shutter.

[0110] Furthermore, the data receiving and reassembly module includes: a data receiving unit, a header verification unit, a data integrity verification unit, and a data reassembly unit;

[0111] The data receiving and reassembly module is deployed on the high-security side to receive, verify, and reassemble data transmitted from the unidirectional optical gate, and then forward it to the target system.

[0112] The data receiving unit receives encapsulated data units transmitted from the unidirectional optical shutter in real time.

[0113] The header verification unit extracts the encapsulation header of the data unit, calculates the header check code and compares it with the recorded value, and checks whether the version number, protocol identifier and data length meet the preset requirements. If there is an abnormality, the data unit is discarded.

[0114] The data integrity verification unit extracts the data integrity verification code at the end of the encapsulation, recalculates the CRC32 check code of the original data and compares it. If they are inconsistent, the data is determined to be corrupted and discarded.

[0115] The data reassembly unit sorts the received data units according to their numbers, splices the data payloads to form a complete original data stream, calculates the hash value and compares it with the hash value provided by the sender to verify data consistency, and forwards it to the target system after successful reassembly.

[0116] Compared with the prior art, the beneficial effects of the present invention are:

[0117] 1. By extracting the communication features of private protocols and building a feature library, combined with a multi-layer matching mechanism, accurate identification and deep detection of private protocols can be achieved, avoiding the security blind spot of traditional unidirectional optical gates that only verify the underlying format.

[0118] 2. After a successful match, compliance verification and content filtering are performed to effectively prevent application-layer attacks and data leaks, thereby improving overall security.

[0119] 3. By encapsulating data, calculating checksums, controlling flow, and performing data reassembly and integrity verification on the high-security side, the reliability and consistency of data transmission are ensured, while audit logs are recorded for easy traceability and analysis afterward.

[0120] 4. Monitor protocol behavior and session status in real time, and promptly trigger security alarms and block transmission for unknown protocols, abnormal characteristics, or behaviors that deviate from preset patterns, forming a proactive defense mechanism and enhancing the dynamic security protection capabilities of the network environment. Attached Figure Description

[0121] Figure 1 This is a flowchart illustrating the method of the proprietary protocol transmission security management system and method based on a one-way communication device according to the present invention.

[0122] Figure 2 This is a schematic diagram of the system structure of the proprietary protocol transmission security management system and method based on a one-way communication device according to the present invention. Detailed Implementation

[0123] Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0124] Example 1: As Figure 1 As shown, the present invention provides a technical solution: a method for managing the security of private protocol transmission based on a one-way communication device. This method includes:

[0125] S1. Extract the communication features of the private protocol, normalize the communication features, and store them in the private protocol feature library;

[0126] S2. Deploy a protocol parsing engine on the low-security side of the unidirectional optical gate to perform deep inspection of outbound data streams and determine whether the data stream belongs to a private protocol; if it is identified as a private protocol, extract the protocol features of the current session.

[0127] S3. Match the extracted protocol features with the private protocol feature library; if the match is successful, perform compliance verification and content filtering on the data content according to the preset security policy; if the match fails, determine it as an unknown protocol and proceed to S6 for processing.

[0128] S4. Encapsulate the data that has passed the compliance verification into a transmission format that allows it to pass through the one-way optical gate, and send it to the high-security side through the one-way optical gate;

[0129] S5. On the high-security side, the received data is reassembled and its integrity and consistency are verified; after the verification is passed, an audit log is recorded and forwarded to the target system;

[0130] S6. Monitor protocol behavior and session status in real time. If an unknown protocol, abnormal protocol characteristics, or session behavior deviates from the preset mode is detected, a security alarm will be triggered and the current transmission link will be blocked.

[0131] S1 includes:

[0132] The communication features include protocol header structure, payload structure, instruction set, and session behavior pattern;

[0133] Collect the header data included in the private protocol sample, denoted as H. i =(h i1 ,h i2 ,…,h ik ), where i = 1, 2, ..., N; k is the number of header fields; h i1 ,h i2 ,…,h ik These represent the values ​​of the 1st, 2nd, and kth header fields of the i-th private protocol sample, respectively.

[0134] Extract the feature parameters of each header field, including the field length L. ij Range of values ​​R ij =[min(h ij ),max(h ij Field type T ij ;

[0135] Payload data P for each private protocol sample i =(p i1 ,p i2 ,…,p im The parsing is performed, where m is the number of payload fields; p i1 ,p i2 ,…,p im These represent the values ​​of the 1st, 2nd, and mth payload fields of the i-th private protocol sample, respectively; the delimiter D of the payload field is obtained. i And extract the length M of each load field. ij Data type S ij Field meaning description Cij ;

[0136] Identify the instruction code I in each private protocol samplei =(i i1 i i2 ,…i in ), where n is the number of instructions, i i1 i i2 ,…i in These represent the 1st, 2nd, and mth instruction codes of the i-th private protocol sample, respectively; record the functional description F corresponding to each instruction code. ij Number of instruction parameters Q ij Parameter format G ij Execution response format H ij ;

[0137] Collect session interaction data from each private protocol sample, including the establishment request R i1 Response R i2 Data transmission sequence, session close request C i1 Response C i2 ;

[0138] Extract session behavior features, including session establishment time T. is Session duration T id Data transmission rate V i Number of session interactions N i ;

[0139] The collected data is normalized.

[0140] The normalized communication features are classified and stored according to protocol categories to build a private protocol feature library;

[0141] S2 includes:

[0142] A data acquisition unit is deployed on the low-security side of the unidirectional optical shutter to collect outbound data streams from the low-security side to the high-security side in real time. The collected data streams are in data packets as the basic unit, and each data packet contains header information and data payload.

[0143] Preprocess the collected data packets;

[0144] Extract the header data of the data packet and compare it with the header structure features of each protocol in the private protocol feature library; calculate the matching degree M of the header fields. h ;

[0145] If a certain protocol i makes M h ≥θ h If so, the data packet is preliminarily determined to belong to protocol i;

[0146] For data packets initially determined to belong to protocol i, extract the packet payload data and parse it according to the payload format characteristics of protocol i; check whether the delimiter of the payload field matches D.i Consistency: Do the field lengths and data types of each load field conform to M? ij and S ij Requirements;

[0147] Calculate the matching degree M of the load format p If M p ≥θ p Then it is further determined that the data packet to be detected belongs to protocol i;

[0148] Extract the instruction code from the payload data, and match it with the instruction set I of protocol i. i Perform a comparison; check if the instruction code is in instruction set I. i The question arises: do the number and format of the instruction parameters conform to the requirements of the corresponding instruction? ij and G ij ;

[0149] Calculate the matching degree M of the instruction set i If M i ≥θ i If so, the data packet to be detected is ultimately determined to belong to protocol i, that is, it is identified as a private protocol;

[0150] For data streams identified as private protocols, the session process corresponding to the data stream is tracked, and the protocol features of the current session are extracted, including session header structure features, payload format features, instruction set features, and session behavior pattern features. The extracted features are then stored as a feature vector F=(f1,f2,…,f t ), where t is the feature dimension;

[0151] S3 includes:

[0152] The extracted current session protocol feature vector F is compared with the feature vectors F of each protocol in the private protocol feature library. k =(f k1 ,f k2 ,…,f kt Similarity calculation is performed using the cosine similarity algorithm, with the following formula:

[0153] ;

[0154] Among them, f l f is the l-th feature value of the current session feature vector F. kl F is the k-th protocol feature vector in the private protocol feature library. k The l-th eigenvalue, Sim(F,F) k ) represents the cosine similarity between two feature vectors, with a value range of [0,1]. The closer the value is to 1, the higher the similarity.

[0155] Pre-set similarity threshold θs If Sim(F,F) k )≥θ s If the current session protocol matches protocol k in the private protocol feature library, then the current session protocol is determined to be a successful match; if the Sim(F,F) of all protocols k are... k )<θ s If the match fails, the current session protocol is an unknown protocol, and the process is transferred to S6 for handling.

[0156] For successfully matched session protocols, the data content is subjected to compliance verification according to a preset security policy; the compliance verification includes data content verification, instruction permission verification, and session behavior compliance verification.

[0157] If the data content compliance verification fails, content filtering operations will be performed, including: sensitive information filtering, illegal instruction filtering, and abnormal behavior data filtering.

[0158] S4 includes:

[0159] Define the transmission format that is allowed to pass through the unidirectional optical gate, including the package header, data payload, and package tail;

[0160] Calculate the CRC32 checksum of the original data. data , serving as a data integrity check code at the end of the encapsulation;

[0161] The XOR check algorithm is used to perform an XOR operation on the bytes of each field in the header to obtain the CRC checksum of the encapsulated header. header ;

[0162] The encapsulation header, original data, and encapsulation tail are combined in sequence to form the encapsulated data unit, Data.

[0163] Select the physical transmission link corresponding to the one-way optical shutter, adopt a flow control mechanism, control the data transmission rate v according to the transmission bandwidth B of the one-way optical shutter and the network conditions, so that v≤B, and number the data units to be transmitted and send them in the order of the numbers;

[0164] S5 includes:

[0165] A data receiving unit is deployed on the high-security side to receive encapsulated data units (Data) transmitted from the unidirectional optical gate in real time.

[0166] Extract the encapsulation header of the data unit and calculate the checksum of the encapsulation header. and the CRC recorded in the header header Perform a comparison; if If the encapsulation head is damaged, the data unit is discarded; if Check whether the version number in the encapsulation header is consistent with the version number supported by the high-security side, whether the protocol identifier is within the preset allowable range, and whether the data length does not exceed the preset maximum data unit length. If there is an abnormality, discard the data unit.

[0167] Extract the end of the data unit's encapsulation to obtain the CRC checksum. data And recalculate the CRC32 checksum on the original data. ;like If the original data is corrupted during transmission, the data unit is discarded; if If so, then data restructuring will be performed;

[0168] Based on the data unit number, the received data units are sorted in ascending order of number; the data payload of each sorted data unit is extracted, and the data payloads are spliced ​​together in order to form a complete original data stream.

[0169] Calculate the hash value of the received original data stream and compare it with the hash value of the original data stream provided by the sender before data transmission; if the hash values ​​before and after reception are consistent, the reassembly is considered successful; otherwise, the reassembly is considered to have failed.

[0170] The reassembled and verified original data stream is forwarded to the target system;

[0171] Example 2: Figure 2 As shown, in order to better implement the above method, a private protocol transmission security management system based on a one-way communication device is also provided. The private protocol transmission security management system includes: a protocol parsing module, a protocol matching and security verification module, a data encapsulation and transmission module, and a data receiving and reassembly module.

[0172] The protocol parsing module, deployed on the low-security side of the unidirectional optical shutter, is used to perform deep inspection of outbound data streams, identify private protocols, and extract protocol features of the current session.

[0173] The protocol parsing module includes: a data acquisition unit, a data preprocessing unit, a protocol recognition unit, and a feature extraction unit;

[0174] The data acquisition unit collects outbound data streams from the low-security side to the high-security side in real time, using data packets as the basic unit to obtain the packet header information and data payload.

[0175] The data preprocessing unit performs deduplication and fragmentation reassembly on the collected data packets. The deduplication process uses a hash algorithm to calculate the hash value of the data packets and remove duplicate data packets. The fragmentation reassembly reassembles the fragmented data into complete data packets according to IP fragmentation rules.

[0176] The protocol identification unit extracts the header data, payload data, and instruction code of the data packet, compares them with the private protocol feature library, calculates the header matching degree, payload matching degree, and instruction matching degree, and determines whether the data stream belongs to the private protocol by using a threshold.

[0177] The feature extraction unit, for data streams identified as having a private protocol, tracks the session process of the data stream, extracts the protocol features of the current session, including header structure features, payload format features, instruction set features, and session behavior pattern features, and stores them as feature vectors;

[0178] The protocol matching and security verification module includes: a feature matching unit, a compliance verification unit, and a content filtering unit;

[0179] The protocol matching and security verification module is used to match the extracted protocol features with a private protocol feature library and perform compliance verification and content filtering according to security policies.

[0180] The feature matching unit calculates the cosine similarity between the current session protocol feature vector and the feature vectors of each protocol in the private protocol feature library, and determines whether the match is successful by using a similarity threshold; if the match fails, it is marked as an unknown protocol and subsequent processing is triggered.

[0181] The compliance verification unit performs data content verification, command permission verification, and session behavior compliance verification on successfully matched session protocols. Among them, data content verification uses regular expressions to match sensitive information and checks the data value range and format specifications; command permission verification verifies the legality of commands through a preset command permission list; and session behavior compliance verification checks whether the session duration and data transmission rate exceed preset ranges.

[0182] The content filtering unit performs filtering operations on data that fails compliance verification, including using data desensitization technology to filter sensitive information, directly discarding data packets containing illegal instructions, discarding abnormal behavior data or terminating the session according to the filtering policy, and recording filtering logs.

[0183] The data encapsulation and transmission module includes: an encapsulation format definition unit, a checksum calculation unit, a flow control unit, and a data transmission unit;

[0184] The data encapsulation and transmission module is used to encapsulate the data that has passed the compliance verification into a transmission format that allows it to pass through the one-way optical gate, and then send it to the high-security side through the one-way optical gate.

[0185] The encapsulation format definition unit defines the transmission format that is allowed to pass through the unidirectional optical gate, including the encapsulation header, data payload, and encapsulation tail.

[0186] The check code calculation unit calculates the CRC32 check code of the original data as the data integrity check code, and uses the XOR check algorithm to calculate the check code of the encapsulation header.

[0187] The flow control unit controls the data transmission rate based on the transmission bandwidth of the one-way optical shutter and network conditions;

[0188] The data transmission unit numbers the encapsulated data units and transmits the data in numerical order through the physical transmission link of the unidirectional optical shutter.

[0189] The data receiving and reassembly module includes: a data receiving unit, a header verification unit, a data integrity verification unit, and a data reassembly unit;

[0190] The data receiving and reassembly module is deployed on the high-security side to receive, verify, and reassemble data transmitted from the unidirectional optical gate, and then forward it to the target system.

[0191] The data receiving unit receives encapsulated data units transmitted from the unidirectional optical shutter in real time.

[0192] The header verification unit extracts the encapsulation header of the data unit, calculates the header check code and compares it with the recorded value, and checks whether the version number, protocol identifier and data length meet the preset requirements. If there is an abnormality, the data unit is discarded.

[0193] The data integrity verification unit extracts the data integrity verification code at the end of the encapsulation, recalculates the CRC32 check code of the original data and compares it. If they are inconsistent, the data is determined to be corrupted and discarded.

[0194] The data reassembly unit sorts the received data units according to their numbers, splices the data payloads to form a complete original data stream, calculates the hash value and compares it with the hash value provided by the sender to verify data consistency, and forwards the data to the target system after successful reassembly.

[0195] In an embodiment of the present invention, taking a power monitoring system as an example, the dispatch control center (low security side) needs to transmit telemetry data using a proprietary protocol to the substation production control area (high security side) via a one-way optical shutter; this system is deployed on both sides of the one-way optical shutter, and the specific implementation is as follows:

[0196] On the low-security side, the protocol parsing engine collects domain data streams in real time, identifies private protocol sessions that meet preset characteristics through deep detection, and extracts their protocol feature vectors. By performing cosine similarity matching with a pre-built private protocol feature library, the system confirms that the session is a legitimate IEC 104 extended protocol. Subsequently, the system performs compliance verification on the data content according to security policies, filtering out any abnormal transition commands contained therein. Data that passes the verification is encapsulated in a specified format and sent via a one-way optical gate.

[0197] On the high-security side, the data receiving and reassembly module performs header verification and CRC integrity verification on the received data units, and reassembles them into a complete data stream according to their numbers. After verifying that the hash values ​​are consistent, the data is recorded in the audit log and successfully forwarded to the station control system. Throughout the process, the system monitors the session behavior in real time, and no unknown protocols or abnormal rates have occurred, and the transmission link remains stable and secure.

[0198] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for secure management of private protocol transmission based on a one-way communication device, characterized in that: The private protocol transmission security management method includes: S1. Extract the communication features of the private protocol, normalize the communication features, and store them in the private protocol feature library; S2. Deploy a protocol parsing engine on the low-security side of the unidirectional optical gate to perform deep inspection of outbound data streams and determine whether the data stream belongs to a private protocol; if it is identified as a private protocol, extract the protocol features of the current session. S3. Match the extracted protocol features with the private protocol feature library; if the match is successful, perform compliance verification and content filtering on the data content according to the preset security policy; if the match fails, determine it as an unknown protocol and proceed to S6 for processing. S4. Encapsulate the data that has passed the compliance verification into a transmission format that allows it to pass through the one-way optical gate, and send it to the high-security side through the one-way optical gate; S5. On the high-security side, the received data is reassembled and its integrity and consistency are verified; after the verification is passed, an audit log is recorded and forwarded to the target system; S6. Monitor protocol behavior and session status in real time. If an unknown protocol, abnormal protocol characteristics, or session behavior deviates from the preset mode is detected, a security alarm will be triggered and the current transmission link will be blocked.

2. The method for secure management of private protocol transmission based on a one-way communication device according to claim 1, characterized in that: S1 includes: The communication features include protocol header structure, payload structure, instruction set, and session behavior pattern; Collect the header data included in the private protocol sample, denoted as H. i =(h i1 ,h i2 ,…,h ik ), where i = 1, 2, ..., N; k is the number of header fields; h i1 ,h i2 ,…,h ik These represent the values ​​of the 1st, 2nd, and kth header fields of the i-th private protocol sample, respectively. Extract the feature parameters of each header field, including the field length L. ij Range of values ​​R ij =[min(h ij ),max(h ij Field type T ij ; Payload data P for each private protocol sample i =(p i1 ,p i2 ,…,p im The parsing is performed, where m is the number of payload fields; p i1 ,p i2 ,…,p im These represent the values ​​of the 1st, 2nd, and mth payload fields of the i-th private protocol sample, respectively; the delimiter D of the payload field is obtained. i And extract the length M of each load field. ij Data type S ij Field meaning description Cij ; Identify the instruction code I in each private protocol sample i =(i i1 i i2 ,…i in ), where n is the number of instructions, i i1 i i2 ,…i in These represent the 1st, 2nd, and mth instruction codes of the i-th private protocol sample, respectively; record the functional description F corresponding to each instruction code. ij Number of instruction parameters Q ij Parameter format G ij Execution response format H ij ; Collect session interaction data from each private protocol sample, including the establishment request R i1 Response R i2 Data transmission sequence, session close request C i1 Response C i2 ; Extract session behavior features, including session establishment time T. is Session duration T id Data transmission rate V i Number of session interactions N i ; The collected data is normalized. The normalized communication features are classified and stored according to protocol categories to build a private protocol feature library.

3. The method for secure management of private protocol transmission based on a one-way communication device according to claim 1, characterized in that: S2 includes: A data acquisition unit is deployed on the low-security side of the unidirectional optical shutter to collect outbound data streams flowing from the low-security side to the high-security side in real time. The collected data stream is based on data packets, each of which contains header information and data payload. Preprocess the collected data packets; Extract the header data of the data packet and compare it with the header structure features of each protocol in the private protocol feature library; Calculate the matching degree M of the header field h ; If a certain protocol i makes M h ≥θ h If so, the data packet is preliminarily determined to belong to protocol i; For data packets that are initially determined to belong to protocol i, extract the payload data of the data packets and parse them according to the payload format characteristics of protocol i; Check if the delimiter of the load field matches D. i Consistency: Do the field lengths and data types of each load field conform to M? ij and S ij Requirements; Calculate the matching degree M of the load format p If M p ≥θ p Then it is further determined that the data packet to be detected belongs to protocol i; Extract the instruction code from the payload data, and match it with the instruction set I of protocol i. i Perform a comparison; check if the instruction code is in instruction set I. i The question arises: do the number and format of the instruction parameters conform to the requirements of the corresponding instruction? ij and G ij ; Calculate the matching degree M of the instruction set i If M i ≥θ i If so, the data packet to be detected is ultimately determined to belong to protocol i, that is, it is identified as a private protocol; For data streams identified as private protocols, the session process corresponding to the data stream is tracked, and the protocol features of the current session are extracted; This includes session header structure features, payload format features, instruction set features, and session behavior pattern features, and the extracted features are stored as a feature vector F=(f1,f2,…,f t ), where t is the feature dimension.

4. The method for secure management of private protocol transmission based on a one-way communication device according to claim 1, characterized in that: S3 includes: The extracted current session protocol feature vector F is compared with the feature vectors F of each protocol in the private protocol feature library. k =(f k1 ,f k2 ,…,f kt Similarity calculation is performed using the cosine similarity algorithm, with the following formula: ； Among them, f l f is the l-th feature value of the current session feature vector F. kl F is the k-th protocol feature vector in the private protocol feature library. k The l-th eigenvalue, Sim(F,F) k ) represents the cosine similarity between two feature vectors, with a value range of [0,1]. The closer the value is to 1, the higher the similarity. Pre-set similarity threshold θ s If Sim(F,F) k )≥θ s If the current session protocol matches protocol k in the private protocol feature library, then the current session protocol is determined to be a successful match; if the Sim(F,F) of all protocols k are... k )<θ s If the match fails, the current session protocol is an unknown protocol, and the process is transferred to S6 for handling. For successfully matched session protocols, the data content is subjected to compliance verification according to a preset security policy; the compliance verification includes data content verification, instruction permission verification, and session behavior compliance verification. If the data content compliance verification fails, content filtering operations will be performed, including: sensitive information filtering, illegal instruction filtering, and abnormal behavior data filtering.

5. The method for secure management of private protocol transmission based on a one-way communication device according to claim 1, characterized in that: S4 includes: Define the transmission format that is allowed to pass through the unidirectional optical gate, including the package header, data payload, and package tail; Calculate the CRC32 checksum of the original data. data , serving as a data integrity check code at the end of the encapsulation; The XOR check algorithm is used to perform an XOR operation on the bytes of each field in the header to obtain the CRC checksum of the encapsulated header. header ; The encapsulation header, original data, and encapsulation tail are combined in sequence to form the encapsulated data unit, Data. Select the physical transmission link corresponding to the one-way optical gate, adopt a flow control mechanism, and control the data transmission rate v according to the transmission bandwidth B of the one-way optical gate and the network conditions, so that v≤B, and number the data units to be transmitted and send them in the order of the numbers.

6. The method for secure management of private protocol transmission based on a one-way communication device according to claim 1, characterized in that: S5 includes: A data receiving unit is deployed on the high-security side to receive encapsulated data units (Data) transmitted from the unidirectional optical gate in real time. Extract the encapsulation header of the data unit and calculate the checksum of the encapsulation header. and the CRC recorded in the header header Perform a comparison; if If the encapsulation head is damaged, the data unit is discarded; if Check whether the version number in the encapsulation header is consistent with the version number supported by the high-security side, whether the protocol identifier is within the preset allowable range, and whether the data length does not exceed the preset maximum data unit length. If there is an abnormality, discard the data unit. Extract the end of the data unit's encapsulation to obtain the CRC checksum. data And recalculate the CRC32 checksum on the original data. ;like If the original data is corrupted during transmission, the data unit is discarded; if If so, then data restructuring will be performed; Based on the data unit number, the received data units are sorted in ascending order of number; the data payload of each sorted data unit is extracted, and the data payloads are spliced ​​together in order to form a complete original data stream. Calculate the hash value of the received raw data stream and compare it with the hash value of the raw data stream provided by the sender before data transmission; If the hash values ​​before and after reception are consistent, the reassembly is considered successful; otherwise, the reassembly is considered to have failed. The reassembled and verified original data stream is forwarded to the target system.

7. A proprietary protocol transmission security management system based on a one-way communication device, used to execute the proprietary protocol transmission security management method based on a one-way communication device as described in any one of claims 1-6, characterized in that: The private protocol transmission management system includes: a protocol parsing module, a protocol matching and security verification module, a data encapsulation and transmission module, and a data receiving and reassembly module; The protocol parsing module is deployed on the low-security side of the unidirectional optical shutter and is used to perform deep detection on outbound data streams, identify private protocols, and extract protocol features of the current session. The protocol parsing module includes: a data acquisition unit, a data preprocessing unit, a protocol recognition unit, and a feature extraction unit; The data acquisition unit collects outbound data streams from the low-security side to the high-security side in real time, and obtains the packet header information and data payload of the data packets as the basic unit. The data preprocessing unit performs deduplication and fragmentation reassembly on the collected data packets. The deduplication process uses a hash algorithm to calculate the hash value of the data packets and remove duplicate data packets. The fragmentation reassembly reassembles the fragmented data into complete data packets according to IP fragmentation rules. The protocol identification unit extracts the header data, payload data, and instruction code of the data packet, compares them with the private protocol feature library, calculates the header matching degree, payload matching degree, and instruction matching degree, and determines whether the data stream belongs to the private protocol by using a threshold. The feature extraction unit, for data streams identified as having a private protocol, tracks the session process of the data stream, extracts the protocol features of the current session, including header structure features, payload format features, instruction set features, and session behavior pattern features, and stores them as feature vectors.

8. The private protocol transmission security management system based on a one-way communication device according to claim 7, characterized in that: The protocol matching and security verification module includes: a feature matching unit, a compliance verification unit, and a content filtering unit; The protocol matching and security verification module is used to match the extracted protocol features with a private protocol feature library, and to perform compliance verification and content filtering according to security policies. The feature matching unit calculates the cosine similarity between the current session protocol feature vector and the feature vectors of each protocol in the private protocol feature library, and determines whether the match is successful by using a similarity threshold; if the match fails, it is marked as an unknown protocol and subsequent processing is triggered. The compliance verification unit performs data content verification, instruction permission verification, and session behavior compliance verification on the successfully matched session protocol. Among them, data content verification uses regular expressions to match sensitive information and checks the data value range and format specifications; instruction permission verification verifies the legality of instructions through a preset instruction permission list; session behavior compliance verification checks whether the session duration and data transmission rate exceed preset ranges. The content filtering unit performs filtering operations on data that fails compliance verification, including using data anonymization technology to filter sensitive information, directly discarding data packets containing illegal instructions, discarding abnormal behavior data or terminating the session according to the filtering policy, and recording filtering logs.

9. The private protocol transmission security management system based on a one-way communication device according to claim 7, characterized in that: The data encapsulation and transmission module includes: an encapsulation format definition unit, a checksum calculation unit, a flow control unit, and a data transmission unit; The data encapsulation and transmission module is used to encapsulate the data that has passed the compliance verification into a transmission format that allows it to pass through the one-way optical gate, and send it to the high-security side through the one-way optical gate; The encapsulation format definition unit defines the transmission format that is allowed to pass through the unidirectional optical gate, including the encapsulation header, data payload, and encapsulation tail. The check code calculation unit calculates the CRC32 check code of the original data as the data integrity check code, and uses the XOR check algorithm to calculate the check code of the encapsulation header. The flow control unit controls the data transmission rate based on the transmission bandwidth of the one-way optical shutter and the network conditions. The data transmission unit numbers the encapsulated data units and transmits the data through the physical transmission link of the unidirectional optical shutter in numerical order.

10. The private protocol transmission security management system based on a one-way communication device according to claim 7, characterized in that: The data receiving and reassembly module includes: a data receiving unit, a header verification unit, a data integrity verification unit, and a data reassembly unit; The data receiving and reassembly module is deployed on the high-security side and is used to receive, verify, and reassemble data transmitted from the unidirectional optical gate, and forward it to the target system. The data receiving unit receives the encapsulated data unit transmitted from the unidirectional optical shutter in real time; The header verification unit extracts the encapsulation header of the data unit, calculates the header check code and compares it with the recorded value, and checks whether the version number, protocol identifier and data length meet the preset requirements. If there is an abnormality, the data unit is discarded. The data integrity verification unit extracts the data integrity verification code at the end of the encapsulation, recalculates the CRC32 check code of the original data and compares it. If they are inconsistent, the data is determined to be corrupted and discarded. The data reassembly unit sorts the received data units according to their numbers, splices the data payloads to form a complete original data stream, calculates the hash value and compares it with the hash value provided by the sender to verify data consistency, and forwards it to the target system after successful reassembly.

Images