Cross-domain data security isolation transmission method

Abstract

The invention provides a cross-domain data security isolation transmission method, and relates to a communication method. The method comprises the following steps: dividing to-be-transmitted data into a plurality of data blocks at an external network host; adding metadata to each data block; the metadata comprises a session identifier, a block serial number, a total block number and a data global integrity check value; concurrently executing security check on the plurality of data blocks; sending the data blocks passing the security check to an intranet host through a physically isolated one-way transmission channel; the received data blocks are recombined at the intranet host according to the session identifier, the block serial number and the total block number; and verifying the integrity of the recombined data based on the data global integrity verification value.

Description

TECHNICAL FIELD

[0001] The present application relates to a communication method, in particular to a cross-domain data security isolation transmission method. BACKGROUND

[0002] The existing data isolation exchange system deployment mode is as shown in Figure 5 , which comprises:

[0003] (1) Service terminal: responsible for generating and accepting service data, responsible for initiating data transmission request or accepting data transmission.

[0004] (2) Exchange proxy device: after the exchange proxy device receives the service data, the data is locally landed and preliminarily checked, and the service data is protocol stripped, and the data payload is encapsulated by a private transmission protocol and sent to the inter-network exchange device.

[0005] (3) Inter-network exchange device: the inter-network exchange device receives one-way transmission data and transmits it to the opposite end of the exchange device through isolation hardware (such as one-way optical gate) to ensure one-way data transmission.

[0006] When the data isolation exchange system adopts the sequential transmission mode, it has the following defects:

[0007] 1. In the sequential transmission mode, when a large file enters the time-consuming security check link, the high-cost ferry hardware can only be completely idle and wait, and cannot process subsequent tasks, because it must wait for a task to complete all processes.

[0008] 2. The sequential transmission mode adopts the first-in-first-out queue mechanism, and the transmission delay of any task is equal to the sum of the processing time of all tasks in front of it. A long-tailed task with slow processing will block all subsequent tasks indefinitely. The system cannot intelligently schedule according to business priority, resulting in an increase in average response time, and critical business may be delayed due to blocking of ordinary tasks.

[0009] 3. The data isolation exchange system is composed of external hosts, internal hosts and special isolation hardware, and each component has independent computing and I / O resources. However, under the sequential transmission, these resources cannot work cooperatively in parallel, so that the hardware investment of the system cannot fully play its role, the overall resource utilization is very low, and a lot of resources are wasted. SUMMARY

[0010] In order to solve the technical problems existing in the prior art, the purpose of the present application is to provide a cross-domain data security isolation transmission method, which can be completed cooperatively through task block parallel, multi-thread and thread pool isolation, pipeline parallel, priority scheduling and load balancing, etc. Mechanisms, so as to break the bottleneck of sequential transmission and greatly improve the system throughput and response speed.

[0011] To achieve the above-mentioned purposes of the application, the application provides a cross-domain data security isolation transmission method, steps as follows:

[0012] The outer network host divides the data to be transmitted into multiple data blocks;

[0013] Metadata is attached to each data block;

[0014] The metadata includes session identification, block serial number, total block number and data global integrity check value;

[0015] Concurrent security check is performed on the multiple data blocks;

[0016] Data blocks passing the security check are sent to the inner network host via a physically isolated one-way transmission channel;

[0017] The inner network host reorganizes the received data blocks according to the session identification, block serial number and total block number, and checks the integrity of the reorganized data based on the data global integrity check value.

[0018] According to one technical solution of the application, concurrent security check is performed on the multiple data blocks, and the process includes:

[0019] The pointers of the multiple data blocks are stored in a lock-free task queue;

[0020] Multiple security check threads in a pre-created security check thread pool take out the pointers from the lock-free task queue in a non-competitive manner to obtain the corresponding data blocks, and perform virus scanning and content auditing in parallel.

[0021] According to one technical solution of the application, virus scanning and content auditing are performed in parallel, and the process includes:

[0022] A local task queue is configured for each security check thread;

[0023] The pointers of the multiple data blocks are distributed to the local task queues of the security check threads;

[0024] Each security check thread takes out a pointer from the head of its local task queue, and performs virus scanning and content auditing on the data block corresponding to the pointer;

[0025] When the local task queue of any security check thread is empty, the security check thread steals a data block pointer from the tail of the local task queue of another security check thread, and performs virus scanning and content auditing on the data block corresponding to the pointer.

[0026] According to one technical solution of the present invention, data blocks that have passed security checks are sent to an intranet host via a physically isolated unidirectional transmission channel, the process including:

[0027] Store pointers to data blocks that have passed security checks into the processed buffer;

[0028] Retrieve pointers to data blocks from the processed buffer and read the corresponding data blocks based on the pointers;

[0029] The data block is written to a physically isolated unidirectional transmission channel via direct memory access.

[0030] The intranet host receives the data block from the unidirectional transmission channel via direct memory access and stores the data block in the receive buffer, and stores a pointer to the storage location in the receive buffer in the reassembly buffer.

[0031] According to one technical solution of the present invention, multiple ferry threads in the ferry thread pool retrieve data block pointers from the processed buffer, read the corresponding data blocks according to the pointers, and write the data blocks into the unidirectional transmission channel.

[0032] According to one technical solution of the present invention, the process of reassembling received data blocks includes:

[0033] Data blocks are retrieved from the receive buffer by reorganizing multiple reorganization threads in the reorganization thread pool;

[0034] The session table is looked up based on the session identifier in the metadata of the data block;

[0035] The session table is a hash table with session identifiers as keys and session control structures as values.

[0036] The session control structure includes the total number of blocks, the receive bitmap, a pointer to the pre-allocated reassembly buffer, and the corresponding global data integrity check value.

[0037] The reassembly thread locates the reassembly buffer according to the pointer, writes the data block to the position corresponding to the block sequence number according to the block sequence number, and updates the bit corresponding to the block sequence number in the received bitmap.

[0038] Once the received bitmap shows that all data blocks have been received, a hash value is calculated for the reconstructed complete data, and the calculation result is compared with the global integrity check value to perform integrity verification.

[0039] According to one technical solution of the present invention, the intranet host sends data that has passed integrity verification to the intranet business system through asynchronous distribution.

[0040] According to one technical solution of the present invention, the task queue is a multi-level priority queue, with each level corresponding to a different session priority;

[0041] The session priority is included in the metadata;

[0042] Based on the session priority of the data blocks, the pointers of the multiple data blocks are stored in the task queue corresponding to the session priority;

[0043] The security check thread prioritizes retrieving pointers from the high-priority task queue.

[0044] The present invention also provides an electronic device, comprising: one or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, and the one or more computer programs are stored in the memory. When the electronic device is running, the processor executes the one or more computer programs stored in the memory to enable the electronic device to perform the above-described cross-domain data security isolation transmission method.

[0045] The present invention also provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, implement the above-described cross-domain data security isolation transmission method.

[0046] This invention provides a method for secure isolation and transmission of cross-domain data. It achieves this through a combination of mechanisms including task block parallelism, multi-threading and thread pool isolation, pipelined parallelism, priority scheduling, and load balancing. This breaks through the bottleneck of sequential transmission, significantly improving system throughput and response speed. Specifically:

[0047] 1. By introducing concurrent processing and pipeline technology, the processes of data security inspection, transfer and reassembly can be parallelized, allowing the high-cost transfer hardware and CPU resources to work continuously, thereby completely solving the throughput bottleneck and resource idleness problem caused by single-task blocking.

[0048] 2. Implement dynamic priority scheduling and task segmentation mechanism. The system can intelligently adjust the task order according to the urgency of business, ensuring that high-priority small files or urgent data can be processed first, or even jump the queue in the transmission gap of large files, thereby effectively controlling task delays and ensuring the real-time performance of critical business.

[0049] 3. It transforms from a rigid serial mode to a highly efficient parallel processing model, improving transmission efficiency while ensuring absolute security. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Obviously, the drawings described below are merely some embodiments of the present invention, and those skilled in the art can obtain other drawings based on these drawings without creative effort.

[0051] Figure 1 A flowchart illustrating a cross-domain data security isolation transmission method according to an embodiment of the present invention is shown in the diagram.

[0052] Figure 2 A timing diagram illustrating a cross-domain data security isolation transmission method according to an embodiment of the present invention;

[0053] Figure 3 This diagram illustrates the principle of data access and preprocessing for an external network host in a cross-domain data security isolation transmission method according to an embodiment of the present invention.

[0054] Figure 4 This diagram illustrates the principle of security check thread theft in a cross-domain data security isolation transmission method according to an embodiment of the present invention.

[0055] Figure 5 This illustration shows the deployment method of an existing data isolation and exchange system. Detailed Implementation

[0056] The description of the embodiments in this specification should be taken in conjunction with the accompanying drawings, which should form part of the complete specification. In the drawings, the shape or thickness of the embodiments may be exaggerated and may be indicated in a simplified or convenient manner. Furthermore, parts of the various structures in the drawings will be described separately; it is worth noting that elements not shown in the figures or not described in words are in a form known to those skilled in the art.

[0057] The descriptions of the embodiments herein, including any references to directions and orientations, are for ease of description only and should not be construed as limiting the scope of the invention. The following description of preferred embodiments involves combinations of features, which may exist independently or in combination; the invention is not particularly limited to the preferred embodiments. The scope of the invention is defined by the claims. Figures 1-4 As shown; Specific Implementation Method 1

[0059] This embodiment of a cross-domain data security isolation transmission method includes the following steps:

[0060] The host on the external network divides the data to be transmitted into multiple data blocks;

[0061] Attach metadata to each data block;

[0062] Metadata includes session identifier, block sequence number, total number of blocks, and global data integrity check value;

[0063] Perform security checks concurrently on multiple data blocks;

[0064] Data blocks that pass security checks are sent to internal network hosts via physically isolated unidirectional transmission channels;

[0065] The internal network host reassembles the received data blocks based on the session identifier, block sequence number, and total number of blocks; and verifies the integrity of the reassembled data based on the global data integrity check value.

[0066] In this embodiment, the cross-domain data security isolation transmission method splits large files or large batches of data into multiple data blocks (e.g., 4MB / block), and each data block is processed independently. External network hosts can simultaneously perform protocol stripping and security scanning on multiple received data blocks, while internal network hosts receive the verified data blocks in parallel and reassemble them. This approach fully utilizes multi-core CPUs, enabling simultaneous "security checks" and "transfers" of multiple data blocks, avoiding single-task resource monopolies.

[0067] The aforementioned external network host is configured for data access and preprocessing, and the specific process is as follows:

[0068] By using the DPDK (Data Plane Development Kit) framework and lock-free queuing technology, network data can be received at line speed, protocol stripping and segmentation can be completed with zero copying, and the data can be efficiently sent to the processing queue.

[0069] Specifically, network data reception utilizes the DPDK framework at the network I / O layer. By employing UIO (Userspace I / O) / VFIO (Virtual Function I / O) technology, the kernel is bypassed, allowing exclusive access to the network interface card (NIC) and direct polling-mode packet reception in user space. This eliminates the overhead of kernel interrupts, context switching, and packet copying (zero-copy), achieving microsecond-level latency and 10G / 40G / 100G line-speed processing capabilities.

[0070] Protocol stripping: In DPDK's memory pool, TCP / IP packets are directly parsed, the network layer and transport layer headers are stripped off, and the application layer data payload is extracted.

[0071] Data partitioning: A fixed-size partitioning strategy (e.g., 4MB) is used to split the data with minimal CPU overhead. A unique metadata header is generated for each data block, with the following structure:

[0072] Table 1 Metadata Composition

[0073]

[0074] Based on this metadata, the internal host maintains a session table to enable parallel reassembly and integrity verification of out-of-order data blocks.

[0075] This implementation employs a metadata-based session state-aware reassembly mechanism, attaching metadata containing key information such as session_id and block_seq to each data block. Based on this metadata, the internal network host enables parallel reassembly and integrity verification of out-of-order data blocks. This eliminates the need to wait for data blocks to arrive in order during the data reassembly process, seamlessly integrating with front-end parallel processing. Solving the data out-of-order problem caused by parallel processing is crucial for the closed-loop nature of the end-to-end pipeline. It ensures that data remains intact and accurate after high-speed transmission and reassembly. Specific Implementation Method Two

[0077] This embodiment is a further explanation of embodiment one. In this embodiment, security checks are performed concurrently on multiple data blocks. The process includes:

[0078] Store pointers to multiple data blocks into a lock-free task queue;

[0079] Multiple security check threads from a pre-created security check thread pool retrieve pointers from a lock-free task queue in a non-contact manner to obtain the corresponding data blocks; virus scanning and content auditing are performed in parallel.

[0080] In this implementation, the task queue adopts a lock-free circular queue, such as the Disruptor pattern or a custom queue based on CAS (Compare-And-Swap) atomic operations. The receiving thread directly pushes the data block pointer with metadata into the task queue, and multiple security check threads can consume it without contention, completely avoiding the performance loss caused by existing locking mechanisms.

[0081] Thread pool technology is used to manage concurrent tasks, with each security check module configured with its own dedicated thread pool to avoid mutual interference. For example, a separate thread pool is used for virus scanning. This thread pool isolation ensures that high load on one module will not cripple the entire system, guaranteeing the continued smooth operation of critical paths. Specific Implementation Method 3

[0083] This implementation method is a further explanation of implementation method two. In this implementation method, virus scanning and content auditing are performed in parallel. The process includes:

[0084] Configure a local task queue for each security check thread;

[0085] Distribute pointers to multiple data blocks to the local task queues of each security check thread;

[0086] Each security check thread retrieves a pointer from the head of its local task queue and performs virus scanning and content auditing on the data block corresponding to the pointer;

[0087] When the local task queue of any security check thread is empty, the security check thread steals the pointer to the data block from the tail of the task queue of other security check threads, and performs virus scanning and content auditing based on the data block corresponding to the pointer.

[0088] In this embodiment, the security check thread pool adopts the work-stealing thread pool algorithm.

[0089] Each security check thread has its own independent local task queue.

[0090] The security check thread prioritizes processing tasks in its own local queue. When its local queue is empty, it randomly "steals" tasks from the tail of other security check threads' task queues. This achieves load balancing and avoids lock contention in a single global queue, making it particularly suitable for scenarios with significant differences in task execution time (such as scanning small and large files).

[0091] The virus scanning integrates a high-performance virus scanning engine (such as Kaspersky ScanEngine, Sophos Savdi, etc.) through a C / C++ SDK, instead of calling an external command line, thus avoiding process creation overhead.

[0092] Content auditing includes:

[0093] Data Loss Prevention (DLP) uses regular expression libraries (such as Hyperscan) and the YARA rule engine to perform pattern matching on text and binary content.

[0094] File type identification is performed by parsing the file header (Magic Number) rather than the file extension for accurate identification. The aforementioned approach, utilizing a thread pool for security checks and multi-engine integration, maximizes the use of multi-core CPU resources, parallelizes the execution of multiple security checks, and achieves load balancing.

[0095] After each data block is processed, the security check thread manages its status, adding a status field to the metadata header of the data block. The optional values ​​for this field include SCANNING, CLEAN, and INFECTED. The data block is then sent to the next level of processed data buffer.

[0096] The above implementation integrates three major technologies—DPDK (User-space Network I / O), lock-free queuing (zero-lock contention), and work-stealing thread pool (dynamic load balancing)—on an external host. It can receive data at speeds approaching the hardware limits and elastically and efficiently schedule multi-core CPU resources for parallel security checks based on data block priority and system load. This fully unleashes the potential of modern multi-core servers, ensuring that the security check process does not become a new performance bottleneck and enabling differentiated services for different business traffic. Specific Implementation Method Four

[0098] This embodiment is a further explanation of embodiment two or three. In this embodiment, the data block that has passed the security check is sent to the internal network host via a physically isolated unidirectional transmission channel. The process includes:

[0099] Store pointers to data blocks that have passed security checks into the processed buffer;

[0100] Retrieve pointers to data blocks from the processed buffer and read the corresponding data blocks based on the pointers;

[0101] Data blocks are written to physically isolated unidirectional transmission channels via direct memory access.

[0102] Internal network hosts receive data from the one-way transmission channel via direct memory access and store data blocks in the receive buffer, and store a pointer to the storage location in the receive buffer into the reassembly buffer.

[0103] In this embodiment, after completing the security check on the data block, the external host stores the pointer of the data block in the processed buffer. The processed buffer is a pre-allocated contiguous physical memory region managed by the external host's kernel space, and its address is visible to the FPGA. Subsequently, the starting address of the data block in memory is located according to this pointer, and the data block is directly moved from the processed buffer to the sender FIFO of the physically isolated unidirectional transmission channel through the FPGA-controlled DMA engine. The entire process does not require CPU participation in data copying, achieving zero-copy transmission. Similarly, the FPGA on the internal network side is also configured with a DMA engine in the receive direction. When data arrives in the unidirectional channel, the FPGA automatically writes the data to the internal host's receive buffer via DMA.

[0104] Because the external network and the internal network are connected only through a physically isolated unidirectional transmission channel (such as a unidirectional link implemented based on photodiodes, dedicated ASICs, or FPGAs), data can only flow from the external network to the internal network and cannot be leaked in the reverse direction, thus fundamentally ensuring cross-domain security. Detailed Implementation Method Five

[0106] This embodiment is a further explanation of embodiment four. In this embodiment, multiple ferry threads in the ferry thread pool retrieve data block pointers from the processed buffer, read the corresponding data blocks according to the pointers, and write the data blocks into the one-way transmission channel.

[0107] In this implementation, thread pool technology is also used to manage concurrent tasks. The ferry function module is configured with an independent ferry thread pool to avoid interference with the thread pools of other function modules. The ferry thread pool is responsible for data transfer. Specific Implementation Method Six

[0109] This embodiment is a further explanation of embodiment four. In this embodiment, the received data blocks are reassembled, and the process includes:

[0110] Data blocks are retrieved from the receive buffer by reassembling multiple reassembly threads in the reassembly thread pool;

[0111] Look up the session table based on the session identifier in the data block's metadata;

[0112] The session table is a hash table with session identifiers as keys and session control structures as values.

[0113] The session control structure includes the total number of blocks, the receive bitmap, a pointer to the pre-allocated reassembly buffer, and the corresponding global data integrity check value;

[0114] The reassembly thread locates the reassembly buffer based on the pointer, writes the data block to the position corresponding to the block number according to the block number, and updates the bit corresponding to the block number in the receiving bitmap.

[0115] Once the receive bitmap shows that all data blocks have been received, the hash value of the reassembled complete data is calculated, and the calculation result is compared with the global integrity check value to perform integrity verification.

[0116] In this embodiment, session table technology is used to achieve efficient reception and parallel reassembly of data blocks.

[0117] In this process, the intranet host directly writes the received data blocks into the main memory's receive buffer via the FPGA's DMA.

[0118] A hash table is maintained in memory, with the key being session_id and the value being a session control structure. This structure contains: the total number of file blocks, a bitmap (used to mark which blocks have been received), a reassembly buffer pointer, and a global integrity check value for the data, etc.

[0119] The reassembly process also employs thread pool technology to manage concurrent tasks. Each reassembly module has its own dedicated thread pool to prevent interference with thread pools from other modules. The reassembly thread pool is responsible for data block reassembly. It retrieves data blocks from the receive buffer, looks up the session table using the session_id, writes the data blocks to the correct positions in the reassembly buffer according to block_seq, and updates the bitmap.

[0120] Once the bitmap shows that all blocks have been received, the system calculates the SHA-256 hash value of the entire reassembled file and compares it with the preset global integrity check value or policy to ensure that the data has not been tampered with. Detailed Implementation Method Seven

[0122] This embodiment is a further explanation of embodiment six. In this embodiment, the intranet host sends the data that has passed the integrity verification to the intranet business system through asynchronous distribution.

[0123] In this implementation, asynchronous dispatch to the target system is achieved via io_uring, as detailed below:

[0124] Once the data reconstruction is complete and verification is successful, the file is asynchronously sent to the target business system on the intranet using the Linux io_uring or AIO interface. io_uring provides extremely efficient asynchronous I / O capabilities, preventing threads from being blocked while waiting for network responses. Detailed Implementation Method Eight

[0126] This embodiment is a further explanation of one of the embodiments two, three, five, and seven. In this embodiment, the task queue is a multi-level priority queue, with each level corresponding to a different session priority.

[0127] Session priority is included in the metadata;

[0128] Based on the session priority of the data blocks, store pointers to multiple data blocks into the task queue corresponding to the session priority.

[0129] The security check thread prioritizes retrieving pointers from the high-priority task queue.

[0130] In this implementation, multi-level task queues can be set up according to the urgency of the business (e.g., security alarms > daily reports), and high-priority tasks can preempt resources or be processed in the queue.

[0131] Specifically, tasks are intelligently scheduled in the following ways:

[0132] Priority queue: Implements multiple priority levels within a lock-free queue. Higher priority data blocks are always consumed first.

[0133] Weighted Fair Queues (WFQ): Assign different weights to tasks of different priorities to ensure that low-priority tasks can also get some processing opportunities when the system is busy, preventing them from "starving".

[0134] This invention also provides a cross-domain data security isolation transmission system. In addition to achieving the aforementioned functions, it can also monitor the load of each module in real time through a dynamic scheduling algorithm, automatically allocating tasks to idle threads to avoid resource idleness. For example, when the security check module is busy, more threads can be temporarily scheduled to provide support, ensuring overall efficiency.

[0135] The system also exposes metrics in the Prometheus open-source monitoring system format by placing monitoring points along various critical paths (queue depth, thread pool CPU utilization, FPGA throughput, P95 / P99 latency, etc.). A dashboard is built using the Grafana platform to display real-time system health, traffic patterns, and performance bottlenecks. An Alertmanager in Prometheus is configured to send alerts through the system management interface when key metrics (such as queue depth and latency) exceed thresholds.

[0136] In summary, this invention proposes a concurrent data isolation and exchange system based on software definition and hardware acceleration, addressing the performance bottleneck of secure cross-domain data isolation transmission for large-volume concurrent sequential transmission. This solution utilizes DPDK and lock-free task queues for data access and preprocessing, improves security processing efficiency through a worker-stealing thread pool and a multi-engine security inspection SDK, solves file reassembly and asynchronous distribution issues through a session table and io_uring, and finally achieves system observability and controllability through intelligent scheduling and end-to-end monitoring. This significantly improves the performance of the data isolation and exchange method / system while reducing transmission latency, achieving a leap in transmission efficiency without compromising security levels.

[0137] This invention breaks down the transmission process into stages such as receiving, security check, ferrying, and reassembly, with each stage proceeding in parallel. After the external host completes the security check of data block A, it immediately sends it to the ferrying unidirectional transmission channel and simultaneously begins processing data block B, without waiting for A to completely finish. This pipeline mechanism significantly reduces end-to-end latency, enabling hardware resources (CPU, ferrying channel) to operate continuously and efficiently. It changes the existing serial mode of gateway receiving-processing-forwarding, reconstructing the data exchange process into an end-to-end concurrent pipeline from access, processing, ferrying to reassembly. Each stage can process multiple data blocks in parallel, with the output of the previous stage directly becoming the input of the next stage, greatly improving system throughput and resource utilization. This results in an order-of-magnitude improvement in system performance, shifting the system bottleneck from single-point processing capacity to the width of the overall pipeline.

[0138] The system can be deployed in a distributed manner. In this deployment, a load balancer distributes tasks to multiple switching nodes, avoiding single points of failure. By deploying multiple sets of parallel ferry nodes, data is processed locally, reducing network latency. Each node synchronizes its status via heartbeats, enabling automatic failover and improving system availability.

[0139] The cross-domain data security isolation transmission method of the present invention comprises the following steps: dividing the data to be transmitted into multiple data blocks on the external network host; attaching metadata to each data block; the metadata includes a session identifier, block sequence number, total number of blocks, and a global data integrity check value; concurrently performing security checks on multiple data blocks; sending the data blocks that pass the security checks to the internal network host via a physically isolated unidirectional transmission channel; reassembling the received data blocks on the internal network host according to the session identifier, block sequence number, and total number of blocks; and verifying the integrity of the reassembled data based on the global data integrity check value.

[0140] Furthermore, it should be noted that the present invention can be provided as a method, apparatus, or computer program product. Therefore, embodiments of the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, embodiments of the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code.

[0141] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0142] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0143] It should also be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0144] Finally, it should be noted that the above description represents a preferred embodiment of the present invention. It should be pointed out that although preferred embodiments have been described, those skilled in the art, once they understand the basic inventive concept of the present invention, can make various improvements and modifications without departing from the principles described herein. These improvements and modifications should also be considered within the scope of protection of the present invention. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the embodiments of the present invention.

Claims

1. A method for secure isolation and transmission of cross-domain data, characterized in that, The steps are as follows: The host on the external network divides the data to be transmitted into multiple data blocks; Attach metadata to each of the data blocks; The metadata includes session identifier, block sequence number, total number of blocks, and global data integrity check value; Perform security checks concurrently on the multiple data blocks; Data blocks that pass security checks are sent to internal network hosts via physically isolated unidirectional transmission channels; The intranet host reassembles the received data blocks according to the session identifier, block sequence number, and total number of blocks; and verifies the integrity of the reassembled data based on the global data integrity check value.

2. The cross-domain data secure isolation transmission method according to claim 1, characterized in that, The process of concurrently performing security checks on the multiple data blocks includes: Store the pointers to the multiple data blocks into a lock-free task queue; Multiple security check threads from a pre-created security check thread pool retrieve the pointer from the lock-free task queue in a non-contention-free manner to obtain the corresponding data block; and perform virus scanning and content auditing in parallel.

3. The cross-domain data secure isolation transmission method according to claim 2, characterized in that, Parallel virus scanning and content auditing are performed, and the process includes: Configure a local task queue for each security check thread; Distribute pointers to the multiple data blocks to the local task queue of each security check thread; Each security check thread retrieves a pointer from the head of its local task queue and performs virus scanning and content auditing on the data block corresponding to the pointer; When the local task queue of any security check thread is empty, the security check thread steals the pointer to the data block from the tail of the local task queue of other security check threads, and performs virus scanning and content auditing based on the data block corresponding to the pointer.

4. The cross-domain data secure isolation transmission method according to claim 2 or 3, characterized in that, The process of sending data blocks that pass security checks to internal network hosts via a physically isolated unidirectional transmission channel includes: Store pointers to data blocks that have passed security checks into the processed buffer; Retrieve pointers to data blocks from the processed buffer and read the corresponding data blocks based on the pointers; The data block is written to a physically isolated unidirectional transmission channel via direct memory access. The intranet host receives the data block from the unidirectional transmission channel via direct memory access and stores the data block in the receive buffer, and stores a pointer to the storage location in the receive buffer in the reassembly buffer.

5. The cross-domain data secure isolation transmission method according to claim 4, characterized in that, Multiple ferry threads in the ferry thread pool retrieve data block pointers from the processed buffer, read the corresponding data blocks according to the pointers, and write the data blocks into the one-way transmission channel.

6. The cross-domain data secure isolation transmission method according to claim 4, characterized in that, The process of reassembling received data blocks includes: Data blocks are retrieved from the receive buffer by reorganizing multiple reorganization threads in the reorganization thread pool; The session table is looked up based on the session identifier in the metadata of the data block; The session table is a hash table with session identifiers as keys and session control structures as values. The session control structure includes the total number of blocks, the receive bitmap, a pointer to the pre-allocated reassembly buffer, and the corresponding global data integrity check value. The reassembly thread locates the reassembly buffer according to the pointer, writes the data block to the position corresponding to the block sequence number according to the block sequence number, and updates the bit corresponding to the block sequence number in the received bitmap. Once the received bitmap shows that all data blocks have been received, a hash value is calculated for the reconstructed complete data, and the calculation result is compared with the global integrity check value to perform integrity verification.

7. A method for secure isolation and transmission of cross-domain data according to claim 6, characterized in that, Internal network hosts asynchronously distribute data that has passed integrity verification to internal network business systems.

8. The cross-domain data security isolation transmission method according to any one of claims 2-3 or 5-7, wherein the task queue is a multi-level priority queue, and each level corresponds to a different session priority; The session priority is included in the metadata; Based on the session priority of the data blocks, the pointers of the multiple data blocks are stored in the task queue corresponding to the session priority; The security check thread prioritizes retrieving pointers from the high-priority task queue.

9. An electronic device, characterized in that, include: One or more processors, one or more memories, and one or more computer programs; wherein the processor is connected to the memory, the one or more computer programs are stored in the memory, and when the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform the cross-domain data security isolation transmission method as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, Used to store computer instructions, which, when executed by a processor, implement the cross-domain data secure isolation transmission method as described in any one of claims 1 to 8.

Images