File exchange system and method under more than eight isolated networks

Abstract

The invention discloses a file exchange system and method under more than eight isolation networks. The system comprises a target isolation network layer, a file ferry equipment layer and a management isolation network layer, the management isolation network layer provides a management isolation network of the special transfer network; the target isolation network layer comprises all isolation networks needing file exchange, is used for storing a file to be transmitted by a user and receiving a ferried file, and is a source end and a target end of the file; the file ferrying device layer comprises a plurality of file ferrying devices and is used for accessing an isolation network, receiving files, transmitting the files by managing the isolation network and pushing the files to a corresponding target network; the management isolation network layer is only used for file transmission and information interaction between host machines without accessing a user terminal so as to guarantee the transfer security; through multi-device combination and management isolation network transfer, the limitation of eight isolation networks of a single device is broken through, and manual intervention is not needed.

Description

Technical Field

[0001] This invention relates to the field of network isolation technology, specifically to a file exchange system and method for more than eight isolated networks. Background Technology

[0002] To ensure network security, enterprises or organizations typically divide their internal networks into multiple isolated networks (different isolated networks cannot communicate directly and require dedicated equipment for relay). As business expands and security domain levels become more refined, the number of isolated networks gradually increases, and in some scenarios, there may be a dozen or even more isolated networks.

[0003] When the number of isolated networks is ≤8, a single secure data transfer device can meet the file exchange requirements. This device integrates 8 physical network ports, with each port corresponding to one isolated network. It directly connects to the isolated network via these hardware ports, enabling file transfer between different isolated networks. For example, existing technology CN117640234A discloses a multi-network secure data exchange system based on domestically developed IT products, which supports real-time data transfer between 2-8 isolated network environments.

[0004] However, when the number of isolated networks exceeds 8, due to the hardware limit of 8 physical network ports on a single device, it is impossible to directly access all isolated networks. File exchange must be achieved through a combination of multiple devices. Assuming there are 15 isolated networks, the current deployment method of combining two devices is as follows: Figure 1 As shown, isolation networks 1, 2-7, and 8 are connected to file transfer device A; isolation networks 8, 9-14, and 15 are connected to file transfer device B; isolation network 8 is a shared access network for devices A and B. However, this method has the following problems:

[0005] 1. Strong network dependency: Multiple devices (such as devices A and B) must rely on an "intermediate isolation network" (such as network 8) to achieve data connection, and the user terminals of the intermediate network need to access the corresponding network ports of multiple devices at the same time, which increases the complexity of network configuration and security risks.

[0006] 2. High degree of manual intervention: Files cannot be directly transferred from the source network to the target network (e.g., ... Figure 1 (From network 1 to network 9), the file needs to be transferred from isolation network 1 to isolation network 8 first, then downloaded to the local device via a personal terminal under isolation network 8, and then uploaded from isolation network 8 of device B to network 9. This requires manual completion of the two operations of "downloading the file from device A → uploading to device B" in the intermediate network, which is inefficient.

[0007] 3. Insufficient intelligence: In multi-isolated network scenarios, there is no unified network information management and data scheduling mechanism, and the target network corresponding to the device cannot be automatically identified. Users need to manually determine the transmission path; for example, users must know to transfer files through network 8.

[0008] 4. Lack of unified combination device: Multiple devices operate independently, which cannot form a "logical single device" user experience. Users need to operate each device separately, resulting in poor usability. Summary of the Invention

[0009] In view of the technical defects mentioned in the background art, the purpose of this invention is to provide a file exchange system and method with more than 8 isolated networks, aiming to at least solve one of the technical problems in the related art to a certain extent.

[0010] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a file exchange system with more than eight isolated networks, the system comprising a target isolated network layer, a file transfer device layer, and a management isolated network layer; wherein the management isolated network layer is used to provide a management isolated network for a dedicated relay network;

[0011] The target isolation network layer contains all the isolation networks that need to exchange files. It is used to store the files to be transferred by the user and to receive the transferred files. It is the source and destination of the files.

[0012] The file transfer device layer includes multiple file transfer devices, which are responsible for accessing the isolated network, receiving files, transferring files through the management isolated network, and pushing files to the corresponding target network; each device includes a host machine, at least one KVM virtual machine, and at least one physical network port;

[0013] The management isolation network layer is used to provide a dedicated communication channel for file transfer and information exchange between host machines only, without accessing user terminals, in order to ensure the security of the relay.

[0014] As a specific implementation of this application, the host machine of any device can obtain a full list of isolated network addresses corresponding to the isolated networks and physical network ports of other file transfer devices through the management isolation network, so as to achieve unified management of full isolated network information.

[0015] As a specific implementation of this application, within the same file transfer device, one physical network port is bound to one KVM virtual machine. After the file enters the physical network port, it is first transferred to the corresponding KVM virtual machine and then transferred to the host machine, avoiding direct interaction across networks.

[0016] As one specific implementation of this application, all KVM virtual machines within the same file transfer device establish internal connections with the host machine, and the host machine uniformly receives files from each virtual machine and schedules file transfer.

[0017] As a specific implementation of this application, the host machines of all file transfer devices are connected to the management isolation network through independent network ports, and the host machines realize information query and file transfer through the network, forming a cross-device relay link.

[0018] Secondly, embodiments of the present invention also provide a file exchange method for more than 8 isolated networks, applied to the file exchange system for more than 8 isolated networks described in the first aspect, the method comprising the following steps:

[0019] Receive a file; wherein the file is uploaded by the user through the corresponding shuttle device x logged in on the source isolation network, and a target isolation network is specified;

[0020] The KVM virtual machine on device x receives the file and transfers it to the host machine of device x;

[0021] Device X queries the full list of isolated network addresses on the host machine to confirm the device Y corresponding to the target isolated network;

[0022] Device x host machine transfers files to device Y host machine through the management isolation network;

[0023] Device Y, the host machine, transfers files to the KVM virtual machine corresponding to the target isolated network;

[0024] Download the file by logging into device Y on the target isolated network.

[0025] As a preferred implementation of this application, the method further includes:

[0026] If the source isolation network and the target isolation network are connected to the same device; that is, X=Y, then the host machine of device X will directly transfer the file to the target isolation network.

[0027] As one specific implementation of this application, the management isolation network is independent of the ordinary isolation network and is used only for host machine communication to prevent relay data from being accessed by ordinary users.

[0028] The advantages achieved by the embodiments of the present invention through a technical solution based on a management isolation network and host machine collaboration are as follows:

[0029] 1. Breaking through hardware limitations, by combining multiple devices and managing isolated network relays, the hardware limit of 8 network ports on a single device is broken, theoretically supporting file transfer of an unlimited number of isolated networks;

[0030] 2. Fully automated transmission: files can be transferred from the source network to the target network without manual intervention or intermediate network download-upload operations, thus reducing manual operation costs.

[0031] 3. High security assurance: the management isolation network is independent of the ordinary isolation network and is used only for host machine communication, preventing relay data from being accessed by ordinary users; at the same time, KVM virtual machines ensure network isolation within a single device, which meets the requirements of security domain division.

[0032] 4. High ease of use: Multiple devices are managed and isolated to form a logical single device. Users only need to select the source isolation network and the target isolation network, without having to worry about the devices involved in file transfer, which greatly reduces the complexity of operation. Attached Figure Description

[0033] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the accompanying drawings used in the description of the specific embodiments or the prior art will be briefly introduced below.

[0034] Figure 1 This is a schematic diagram of a deployment method with more than 8 isolated networks in the existing technology;

[0035] Figure 2 This is an architectural diagram of a single file transfer device provided in an embodiment of the present invention;

[0036] Figure 3 This is a schematic diagram of a file exchange system with more than 8 isolated networks provided in an embodiment of the present invention;

[0037] Figure 4 This is a diagram of a multi-device combined deployment architecture provided in an embodiment of the present invention;

[0038] Figure 5 This is a flowchart of a file exchange method for more than 8 isolated networks provided in an embodiment of the present invention. Detailed Implementation

[0039] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0040] It should be understood that, when used in this specification and the appended claims, the terms "comprising" and "including" indicate the presence of the described features, integrals, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0041] It should be noted that, unless otherwise stated, the technical terms used in this embodiment have the common meaning as understood in the relevant technical field.

[0042] Please refer to Figures 2 to 3 This invention provides a file exchange system with more than eight isolated networks. The system includes a target isolated network layer, a file transfer device layer, and a management isolated network layer. The management isolated network layer is used to provide a dedicated transit network for the management of the isolated network.

[0043] The target isolation network layer contains all the isolation networks that need to exchange files. It is used to store the files to be transferred by the user and to receive the transferred files. It is the source and destination of the files.

[0044] The file transfer device layer includes multiple file transfer devices, which are responsible for accessing the isolated network, receiving files, transferring files through the management isolated network, and pushing files to the corresponding target network; each device includes a host machine, at least one KVM virtual machine, and at least one physical network port;

[0045] The management isolation network layer is used to provide a dedicated communication channel for file transfer and information exchange between host machines only, without accessing user terminals, in order to ensure the security of the relay.

[0046] In this embodiment, the corresponding target network is the network to which the file is transferred;

[0047] The architecture of a single file transfer device is as follows: Figure 2 As shown: The host machine is the core, connecting virtual machines such as kvm1-kvm5; kvm1 corresponds to isolation network 1, kvm2 corresponds to isolation network 2, kvm3 corresponds to isolation network 3, kvm4 corresponds to isolation network 4, kvm5 corresponds to isolation network 5, and the remaining kvm virtual machines correspond to other isolation networks;

[0048] Hardware components: Each device contains 8 physical network ports, and each network port is connected to only one isolated network;

[0049] Internal isolation: Isolation is achieved through KVM virtual machines (Kernel-based Virtual Machines). One KVM virtual machine corresponds to one physical network port, ensuring that different isolated networks do not interact directly.

[0050] The device has a built-in host (used for device management and data scheduling). The host can share a network port with an isolated network or be configured with a dedicated network port for management.

[0051] The multi-device combined deployment architecture of the present invention is as follows: Figure 4 As shown (file transfer device A is connected to isolation networks 1-7; file transfer device B is connected to isolation networks 8-14; file transfer device C is connected to isolation networks 15-21; the host machines of devices A, B, and C are all connected to "management isolation network 22").

[0052] Independent host management: Each file transfer device is configured with an independent physical network port, which is used only for communication between hosts;

[0053] Management Isolation Network Access: All devices' host network ports are uniformly connected to the "Management Isolation Network" (such as Network 22). This network is only used for host communication and is not connected to ordinary user terminals to ensure the security of the isolation network.

[0054] Cross-device information sharing: The host machine of any device can obtain the "isolated network-physical network port" correspondence of other devices through the management of the isolated network, so as to realize the unified management of all isolated network information;

[0055] Direct data transfer: Files can be directly transferred from the source network to the target network via the path "source network → device host → management isolation network → target device host → target network" without manual intervention from intermediate networks.

[0056] This solution is designed according to a three-tier architecture, from top to bottom as follows:

[0057] First layer: Target isolation network layer: contains all isolation networks that need to exchange files (such as 1-7, 8-14, 15-21), and is the "source" and "target" of the files;

[0058] The second layer: File transfer device layer: consists of multiple file transfer devices (such as A, B, C), each device containing three core components: "host machine, KVM virtual machine, and physical network port";

[0059] The third layer: Management isolation network layer: a dedicated relay network (such as network 22), which only connects the host machines of each device and does not participate in access by ordinary users.

[0060] To facilitate understanding of this scheme, the functions of each level are shown in Table 1.

[0061] Table 1 Functions and Roles of Each Level

[0062] Equipment / Components Belonging level Functions and uses Target isolation network Target isolation network layer It stores user files to be transferred and receives files after they have been transferred; it serves as the "starting point" and "end point" of file exchange, and does not communicate directly with other isolated networks. Document transfer equipment (A / B / C) Document transfer equipment layer The core relay platform is responsible for accessing the isolated network, receiving files, managing file transfers through the isolated network, and pushing files to the target network. Host machine (built into the device) Document transfer equipment layer Device management core: Querying isolated network information of other devices, establishing communication connections between host machines, and scheduling file relay paths. KVM virtual machine (built into the device) Document transfer equipment layer To achieve logical isolation: one virtual machine corresponds to one physical network port, ensuring that files on different isolated networks on the same device do not directly interact. Physical network port (device hardware) Document transfer equipment layer Hardware access interfaces: Each device contains 8 physical network ports, with each port corresponding to one target isolated network, serving as the "physical entry and exit point" for files. Managing isolated networks Management Isolation Network Layer Dedicated communication channel: Used solely for data transmission and information exchange between host machines, not connected to user terminals, ensuring relay security.

[0063] Target isolation network and physical network port: One-to-one connection. Each target isolation network is connected to a file transfer device through one physical network port. Files can only enter / leave the device through the physical network port.

[0064] Physical network port and KVM virtual machine: Within the same device, one physical network port is bound to one KVM virtual machine. After a file enters the physical network port, it is first transferred to the corresponding KVM virtual machine and then to the host machine, avoiding direct interaction across networks.

[0065] KVM Virtual Machines and Host Machine: All KVM virtual machines on the same device establish internal connections with the host machine. The host machine receives files from each virtual machine and schedules file forwarding.

[0066] Host machine and management isolation network: The host machines of all devices are connected to the management isolation network through independent network ports. The host machines can realize "information query" and "file transfer" through this network, forming a cross-device relay link.

[0067] Specific examples are as follows:

[0068] Taking "22 isolation networks (numbers 1-21) + 3 file transfer devices (A, B, C) + 1 management isolation network (number 22)" as an example, the implementation steps are explained in detail.

[0069] 1. Equipment Deployment and Configuration

[0070] Hardware connection:

[0071] Device A's 7 physical network ports are connected to isolation networks 1-7 (a total of 7 isolation networks), Device B is connected to networks 8-14, and Device C is connected to networks 15-21;

[0072] Each of the host machines of devices A, B, and C is configured with an independent management network port and is connected to the management isolation network 22.

[0073] Software configuration:

[0074] Import a "full list of isolated network addresses" into the host machine of each device. This list contains "isolated network number - corresponding access device - device host machine IP" (e.g., network 1 → device A → 192.168.0.1; network 9 → device B → 192.168.0.2).

[0075] 2. File transfer process (taking "Network 1 → Network 9" as an example)

[0076] User operation: On the terminal of isolation network 1, the user logs into the file exchange interface of device A, uploads the file to be transferred, and selects the target isolation network as "9";

[0077] Device A receives files: The KVM virtual machine corresponding to network 1 of device A receives files and automatically transfers them to the host machine of device A;

[0078] Path identification: The host machine of device A queries the "Full Isolation Network Address List" and confirms that network 9 corresponds to device B, and the host machine IP of device B is 192.168.0.2;

[0079] Cross-device relay: The host machine of device A transfers files to the host machine of device B through the management isolation network 22, carrying the identifier "Destination network: 9";

[0080] Device B pushes a file: After receiving the file, the host machine of Device B transfers the file to the KVM virtual machine corresponding to the network 9 according to the identifier "Target Network: 9".

[0081] User file retrieval: On the terminal of isolated network 9, the user logs into the file exchange interface of device B and downloads the file that has been transferred.

[0082] The advantages of the above solution, achieved through a technical approach based on a management isolation network and host machine collaboration, are as follows:

[0083] 1. Breaking through hardware limitations, by combining multiple devices and managing isolated network relays, the hardware limit of 8 network ports on a single device is broken, theoretically supporting file transfer of an unlimited number of isolated networks;

[0084] 2. Fully automated transmission: files can be transferred from the source network to the target network without manual intervention or intermediate network download-upload operations, thus reducing manual operation costs.

[0085] 3. High security assurance: the management isolation network is independent of the ordinary isolation network and is used only for host machine communication, preventing relay data from being accessed by ordinary users; at the same time, KVM virtual machines ensure network isolation within a single device, which meets the requirements of security domain division.

[0086] 4. High ease of use: Multiple devices are managed and isolated to form a logical single device. Users only need to select the source isolation network and the target isolation network, without having to worry about the devices involved in file transfer, which greatly reduces the complexity of operation.

[0087] Based on the same inventive concept, this invention also provides a file exchange method for more than eight isolated networks, applied to the file exchange system for more than eight isolated networks described in the first aspect, referring to... Figure 5 The method includes the following steps:

[0088] S101, Receive file; wherein the file is uploaded by the user through logging into the corresponding shuttle device x in the source isolation network, and a target isolation network is specified;

[0089] S102, the KVM virtual machine of device x receives the file and transfers it to the host machine of device x;

[0090] S103, Device x's host machine queries the full list of isolated network addresses to confirm the device Y corresponding to the target isolated network; wherein, the "full list of isolated network addresses" is pre-imported;

[0091] S104, Device x host machine transfers files to Device Y host machine through the management isolation network;

[0092] S105, Device Y host machine transfers files to the KVM virtual machine corresponding to the target isolated network;

[0093] S106, Download the file by logging into the target isolated network device Y.

[0094] Specifically, the user logs into the target isolated network device Y and downloads the file;

[0095] Where x and Y both represent the device number (i.e., the file transfer device);

[0096] The management isolation network is independent of the ordinary isolation network and is used only for host machine communication to prevent relay data from being accessed by ordinary users.

[0097] Furthermore, if the source isolation network and the target isolation network are connected to the same device; that is, X=Y, then the host machine of device X will directly transfer the file to the target isolation network.

[0098] It should be noted that for a more detailed description of the workflow of the method embodiments, please refer to the aforementioned system embodiments section, which will not be repeated here.

[0099] The advantages of the overall solution, which is based on a management isolation network and host machine collaboration, are as follows:

[0100] 1. Breaking through hardware limitations, by combining multiple devices and managing isolated network relays, the hardware limit of 8 network ports on a single device is broken, theoretically supporting file transfer of an unlimited number of isolated networks;

[0101] 2. Fully automated transmission: files can be transferred from the source network to the target network without manual intervention or intermediate network download-upload operations, thus reducing manual operation costs.

[0102] 3. High security assurance: the management isolation network is independent of the ordinary isolation network and is used only for host machine communication, preventing relay data from being accessed by ordinary users; at the same time, KVM virtual machines ensure network isolation within a single device, which meets the requirements of security domain division.

[0103] 4. High ease of use: Multiple devices are managed and isolated to form a logical single device. Users only need to select the source isolation network and the target isolation network, without having to worry about the devices involved in file transfer, which greatly reduces the complexity of operation.

[0104] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A file exchange system with more than 8 isolated networks, characterized in that, The system includes a target isolation network layer, a file transfer device layer, and a management isolation network layer; wherein, the management isolation network layer is used to provide a management isolation network for a dedicated relay network; The target isolation network layer contains all the isolation networks that need to exchange files. It is used to store the files to be transferred by the user and to receive the transferred files. It is the source and destination of the files. The file transfer device layer includes multiple file transfer devices, which are responsible for accessing the isolated network, receiving files, transferring files through the management isolated network, and pushing files to the corresponding target network; each device includes a host machine, at least one KVM virtual machine, and at least one physical network port; The management isolation network layer is used to provide a dedicated communication channel for file transfer and information exchange between host machines only, without accessing user terminals, in order to ensure the security of the relay.

2. The system as described in claim 1, characterized in that, The host machine of any of the devices can obtain a full list of isolated network addresses corresponding to the isolated networks and physical network ports of other file transfer devices through the management isolation network, so as to achieve unified management of all isolated network information.

3. The system as described in claim 2, characterized in that, Within the same file transfer device, one physical network port is bound to one KVM virtual machine. After a file enters the physical network port, it is first transferred to the corresponding KVM virtual machine and then to the host machine, avoiding direct interaction across networks.

4. The system as described in claim 2, characterized in that, All KVM virtual machines within the same file transfer device establish internal connections with the host machine. The host machine uniformly receives files from each virtual machine and schedules file transfer.

5. The system as described in any one of claims 1 to 4, characterized in that, All host machines of the file transfer devices are connected to the management isolation network through independent network ports. The host machines can query information and transfer files through this network, forming a cross-device relay link.

6. A file exchange method for more than 8 isolated networks, characterized in that, Applied to a file exchange system with more than 8 isolated networks as described in claim 2, the method includes the following steps: Receive a file; wherein the file is uploaded by the user through the corresponding shuttle device x logged in on the source isolation network, and a target isolation network is specified; The KVM virtual machine on device x receives the file and transfers it to the host machine of device x; Device X queries the full list of isolated network addresses on the host machine to confirm the device Y corresponding to the target isolated network; Device x host machine transfers files to device Y host machine through the management isolation network; Device Y, the host machine, transfers files to the KVM virtual machine corresponding to the target isolated network; Download the file by logging into device Y on the target isolated network.

7. The method as described in claim 6, characterized in that, The method further includes: If the source isolation network and the target isolation network are connected to the same device; that is, X=Y, then the host machine of device X will directly transfer the file to the target isolation network.

8. The method as described in claim 7, characterized in that, The management isolation network is independent of the ordinary isolation network and is used only for host machine communication to prevent relay data from being accessed by ordinary users.

Images