High-performance and high-reliability database security synchronization method based on one-way optical shutter

Abstract

The invention belongs to the technical field of network security and database synchronization, and provides a high-performance and high-reliability security synchronization method for solving the problems that an existing one-way optical shutter database is low in synchronization efficiency, high in redundancy and insufficient in reliability. The method comprises the following steps of: dividing the content of a database to be transmitted into a log file for recording full data and a real-time operation instruction type data stream, stripping through a one-way optical shutter outer end protocol to generate bare data, marking a task ID and a serial number, packaging into an isomorphic or heterogeneous data packet according to the type, dynamically optimizing MTU parameters through a formula, adjusting the size of the packet, and transmitting the data to the database to be transmitted. And after the data is transmitted to the inner end through the one-way optical shutter, the inner end unpacks and verifies the data integrity, executes full-amount synchronization on the log file, executes a data stream reduction instruction, triggers a full-amount synchronization mechanism to guarantee consistency, and is also provided with an error recovery and multi-task parallel mechanism. The method improves the transmission efficiency while guaranteeing the safety, reduces the bandwidth loss, and is suitable for the real-time synchronization of the secret-related network database.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a high-performance and highly reliable database security synchronization method based on a one-way optical gate, which is applicable to real-time database synchronization scenarios between classified and unclassified networks. Background Technology

[0002] With the rapid development of communication and network technologies, the construction of computer information systems in government agencies, enterprises, institutions, and organizations has been comprehensively promoted. The rise of e-government, office automation, electronic finance, and e-commerce has greatly boosted social productivity and improved the quality of life. However, at the same time, various cybersecurity issues have also emerged. Cyberattacks such as flood attacks, data eavesdropping, Trojan horse intrusions, data forgery, virus propagation, and system vulnerabilities are rampant on the internet, leading to frequent data leaks and thefts, seriously endangering national security, social stability, and public interests.

[0003] To address the security challenges of data exchange between classified and unclassified networks, unidirectional optical gate systems (hereinafter referred to as "unidirectional optical gates") have become a core application device. Their core feature is the construction of a unidirectional physical transmission channel without backflow, fundamentally blocking the possibility of reverse data flow and achieving secure cross-domain data transmission. However, existing database synchronization solutions based on unidirectional optical gates still have many shortcomings, mainly in terms of transmission efficiency and reliability: Because unidirectional optical gates lack a backflow channel, it is impossible to confirm whether the other end has successfully received the data packet after it has been sent. Traditional solutions often compensate for this deficiency by repeatedly transmitting data packets or adding data redundancy, which results in significant bandwidth loss, and this problem is even more pronounced in high-volume transmission scenarios. Simultaneously, database information transmission has strong real-time requirements; once data is lost, it can easily lead to irreparable business losses. Furthermore, traditional solutions lack differentiated data encapsulation mechanisms, dynamic MTU optimization capabilities, verification and traceability mechanisms, a single synchronization mechanism, and a multi-task parallel and intelligent error recovery architecture. Overall, their synchronization efficiency and reliability are far from meeting the real-time, high-consistency transmission requirements of databases. Therefore, a new method is urgently needed to solve the problems of low database synchronization efficiency, high redundancy, and insufficient consistency and reliability in existing technologies. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a high-performance and highly reliable database security synchronization method based on a unidirectional optical gate. Through private protocol encapsulation, optimal MTU parameter optimization, log sequence encoding, and message authentication code (MAC) verification technology, it achieves efficient and complete data transmission, significantly improving transmission efficiency and reducing bandwidth loss while ensuring data transmission security.

[0005] To address the aforementioned technical problems, this invention provides the following technical solution: a high-performance, highly reliable database security synchronization method based on a unidirectional optical shutter, comprising the following steps:

[0006] Data classification: The database content to be transmitted is divided into two categories: log files and data streams. The log files record the full database data, and the data streams are real-time conversions of database operation instructions.

[0007] Protocol stripping and marking: After receiving the log file and data stream at the external end of the unidirectional light shutter, the protocol is stripped to generate raw data, and the raw data is marked with a task ID and a sequence number. The task ID is used to distinguish the data source type, and the sequence number is used for subsequent data verification and order restoration.

[0008] Differentiated encapsulation: Based on the data type of the raw data, it is encapsulated into homogeneous data packets or heterogeneous data packets. The encapsulation protocol uniformly includes the following structure: the first 2 bytes are packet attributes, which consist of type encoding and quantity encoding; the 3rd-4th bytes are check bits; the 5th-Nth bytes are the data content, and this area carries task ID, log summary and message authentication code (MAC) information;

[0009] The specific encapsulation format of the homogeneous data packet (adapted to log files) is as follows: the first 2 bytes are packet attributes, where the first bit is the type code (a value of 0 indicates a homogeneous data packet), and the last 15 bits are the number of packets; the 3rd and 4th bytes are CRC16 check bits; the 5th and 8th bytes are the original data packet length, used for dynamic allocation of the internal buffer; the 9th and 10th bytes are the task ID; the remaining bytes are the data content, which stores log file data or database operation instructions in fixed blocks.

[0010] The specific encapsulation format of heterogeneous data packets (adapted data streams) is as follows: the first 2 bytes are packet attributes, where the first bit is the type code (a value of 1 indicates a heterogeneous data packet), and the last 15 bits are the number of packets; bytes 3-4 are CRC32 check bits; bytes 5-N are the original data packet marking queue, and the total length of this marking queue is calculated as (4-byte packet length + 2-byte task ID) × number of merged packets; the data content is divided into storage areas according to the operation type, specifically including INSERT area, UPDATE area and DELETE area, and each area has a 2-byte operation code and a 4-byte data length identifier in the header;

[0011] Dynamic MTU Optimization: Based on the maximum transmission unit (MTU) of a unidirectional optical gate transmission link, it is dynamically optimized using a formula. Calculate the optimal MTU value and adjust the data packet size accordingly to ensure that the encapsulated data packet does not exceed the optimal MTU value, thus avoiding efficiency loss caused by fragmented transmission.

[0012] One-way transmission and decapsulation verification: The encapsulated data packet is transmitted to the inner end through a one-way optical gate. The inner end decapsulates the data packet according to the preset encapsulation protocol and performs data integrity verification. This includes verifying the CRC16 check bit and data sequence number for log file data packets, verifying the CRC32 check bit for data stream data packets, comparing the MAC digest using the SHA-256 algorithm, and checking the log sequence encoding.

[0013] Data synchronization execution: Perform a full synchronization operation on log files that have passed the unsealing verification; for data streams that have passed the unsealing verification, first match the corresponding database operation permissions in the pre-stored task list according to the task ID it carries, then restore the database operation instructions according to the task ID and execute the corresponding instructions. If the data stream log sequence encoding skips or duplicates is detected, an incremental retransmission request is automatically triggered.

[0014] Full synchronization as a fallback: After a large-scale data change in the database, a full synchronization mechanism is triggered to ensure data consistency between the internal and external databases. The triggering conditions for the full synchronization mechanism include three modes:

[0015] Automatic mode: If the database has not been frequently modified for 30 consecutive minutes and the number of database operation requests per second is less than 10 during this period;

[0016] Manual mode: Full synchronization is manually forced to start by the administrator;

[0017] Emergency mode: When the data stream verification failure rate exceeds 5%, it will automatically downgrade to full synchronization mode.

[0018] In addition, this method also includes an error recovery mechanism and a multi-task parallel processing mechanism:

[0019] Error recovery mechanism: If a data packet experiences a transmission timeout or verification failure, the external end of the one-way light gate will retransmit the lost data packet according to the task ID and sequence number of the data packet; the internal end of the one-way light gate will synchronously record the error log and generate alarm information, and support breakpoint resume and incremental synchronization operations.

[0020] Multi-task parallel processing mechanism: The external end of the unidirectional optical shutter allocates an independent sending queue for each task ID, and the priority of the task queue is set according to the task type, with the priority order being system instruction > log file > data stream; the internal end of the unidirectional optical shutter adopts multi-threaded parallel parsing of data packets, and the task execution order is sorted according to the queue priority.

[0021] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages compared with the prior art:

[0022] A. High transmission efficiency and low bandwidth loss: This invention simplifies the protocol header overhead by lightweighting the proprietary protocol, compressing the protocol header length of homogeneous data packets from 20 bytes in the traditional TCP / IP protocol to 10 bytes, a reduction of 50%. Combined with a dynamic MTU optimization algorithm, under 100Mbps bandwidth, the transmission time of 10GB database logs is shortened from 120 seconds in the traditional method to 75 seconds, an efficiency improvement of 37.5%. In high-traffic scenarios (such as thousands of operation instructions per second), the fusion transmission of data streams and log files increases throughput by more than 40%. At the same time, dynamic MTU optimization reduces memory buffer usage, with actual memory requirements reduced by 15%-25%. Under the same load, the system resource utilization rate is reduced from 70% in the traditional solution to 45%.

[0023] B. Strong data reliability and traceability: This invention introduces a Message Authentication Code (MAC) verification and task ID mechanism. The MAC is generated using the SHA-256 algorithm, which can effectively detect data tampering and corruption. The measured data integrity rate is increased from 95% of the traditional method to 99.9%. The task ID and sequence number mark support breakpoint resume. In an extreme environment simulating a 30% packet loss rate, the traditional method requires more than 3 retransmissions, while this invention improves the packet loss recovery rate to 98% through an intelligent retransmission mechanism, and reduces the additional bandwidth consumption by 60%.

[0024] C. Excellent data consistency and execution logic: This invention ensures that the execution order of the internal database is completely consistent with that of the external database by binding the log sequence encoding with the data flow operation instructions. It can automatically cache out-of-order data packets to avoid logical errors such as "insert first, update later". The full synchronization fallback mechanism eliminates the data fragmentation problem caused by multiple incremental synchronizations. Experiments show that the data consistency error rate is less than 0.01% in 100,000 concurrent operations.

[0025] D. High parsing efficiency: The design of storing heterogeneous data packets according to operation type allows the internal end to directly call the corresponding processing module according to the operation type, reducing parsing time by 30% and greatly improving the overall response speed of data synchronization.

[0026] Other advantages, objectives and features of the invention will be set forth in part in the description which follows, and in part will be apparent to those skilled in the art from an examination of the following, or may be learned from the practice of the invention. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the secure database transmission process of a high-performance, highly reliable secure database synchronization method based on a unidirectional optical shutter, according to the present invention.

[0028] Figure 2This is a diagram of the homogeneous packet protocol for database transmission based on a one-way optical shutter, which is a high-performance and highly reliable database security synchronization method according to the present invention.

[0029] Figure 3 This is a timing diagram of the external data processing of a high-performance and highly reliable database security synchronization method based on a unidirectional optical shutter according to the present invention.

[0030] Figure 4 This is a schematic diagram of the data encapsulation format for a high-performance and highly reliable database security synchronization method based on a unidirectional optical shutter according to the present invention.

[0031] Figure 5 This is a flowchart illustrating the MTU dynamic optimization process of a high-performance, high-reliability database security synchronization method based on a unidirectional optical shutter according to the present invention.

[0032] Figure 6 This is a state diagram of the full synchronization triggering mechanism of a high-performance and high-reliability database security synchronization method based on a unidirectional optical shutter according to the present invention. Detailed Implementation

[0033] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] It should be noted that the terms "vertical," "horizontal," "up," "down," "left," "right," and similar expressions used in this article are for illustrative purposes only and do not represent the only possible implementation.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to limit the invention; the term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0036] like Figure 1-6 As shown, each step in this invention has a clear logical sequence and physical location correspondence. The overall process presents a unidirectional linear architecture of external preprocessing - unidirectional transmission - internal parsing and synchronization. The connection and positional relationships of each step and its supporting mechanisms are as follows:

[0037] Execution logical connection

[0038] S1 is the preprocessing step before the entire synchronization process. After data classification, it is directly output to S2. S2 receives the output data from S1, performs protocol stripping and marking, and then transfers it to S3. S3 performs homogeneous or heterogeneous encapsulation based on the classification results of S1. The encapsulated data enters S4 for dynamic MTU optimization. The adapted data packets output by S4 enter the external sending queue and are transmitted to the internal receiving queue through the unidirectional optical gate link of S5. The internal end first performs the decapsulation verification of S5. After the verification is successful, it branches to perform full synchronization (log file) or incremental instruction execution (data stream) of S6. S7 is a fallback mechanism that is activated after S6 is executed according to the triggering conditions, forming a full-incremental complementary synchronization system with S6. The error recovery mechanism runs through S5-S6 and is automatically triggered when S5 transmission times out or S6 verification fails. The multi-task parallel mechanism covers S3-S6. The external end allocates an independent queue in S3 and sends data in S5 according to priority. The internal end performs multi-threaded parsing and execution in S6 according to priority, working in coordination with the main steps.

[0039] Physical positional relationship

[0040] The data classification module, protocol processing module, encapsulation module, MTU optimization module, and external transmission queue are arranged linearly at the outer end of the unidirectional optical shutter, with each module connected in series. The internal receiving queue, decapsulation verification module, synchronization execution module, and full synchronization trigger module are arranged sequentially at the inner end of the unidirectional optical shutter, corresponding to the external modules in a unidirectional transmission relationship. The error recovery module is deployed on the external transmission queue side (responsible for packet loss retransmission) and the internal decapsulation verification module side (responsible for error recording and alarms). The multi-task priority scheduling module is embedded in the external transmission queue (queue allocation) and the internal execution queue (task sorting).

[0041] In this embodiment, the present invention overcomes the efficiency and reliability bottlenecks of traditional unidirectional optical shutter database synchronization through the synergistic combination of various steps and supporting mechanisms. Its key implementation points and innovative beneficial effects are as follows:

[0042] Implementation Guidelines

[0043] (1) Categorized transmission + differentiated encapsulation: The core is to distinguish the transmission characteristics of log files and data streams, and design encapsulation formats accordingly to avoid the redundancy problem of uniform encapsulation;

[0044] (2) Dynamic MTU adaptation: The key is to calculate the optimal packet size based on the real-time status of the link and eliminate fragmentation transmission loss.

[0045] (3) Multi-dimensional verification + order guarantee: The core is to combine CRC verification, MAC authentication and order encoding to build a multi-layer security barrier;

[0046] (4) Full-incremental fallback + parallel scheduling: The key is to eliminate data fragmentation through full synchronization in multiple modes and improve processing efficiency through priority parallelism.

[0047] Innovative and beneficial effects

[0048] The combination of steps and mechanisms achieves a synergistic benefit of "efficiency improvement, security assurance, and consistency assurance." Compared with traditional solutions, it not only improves the efficiency of 10GB log transmission at 100Mbps bandwidth by 37.5% and the throughput in high-traffic scenarios by more than 40%, but also increases the data integrity rate to 99.9% and the consistency error rate of 100,000 concurrent operations to less than 0.01%. At the same time, it reduces the system resource utilization rate from 70% to 45%, achieving a balance between security and high performance in confidential scenarios.

[0049] Specifically:

[0050] S1 (Data Classification)

[0051] Purpose: To split the database content into two categories: "full log files" and "real-time data streams," thus clarifying the synchronization requirements for different types of data.

[0052] Benefits: It solves the problems of high bandwidth consumption for full transmission and lack of fallback for pure incremental transmission in traditional solutions, and provides a foundation for subsequent differentiated encapsulation and synchronization strategies, achieving a balance between full integrity and incremental real-time performance.

[0053] S2 (Protocol Stripping and Marking)

[0054] Function: To strip away redundant fields from traditional TCP / IP and other protocols to generate raw data, and to mark the data type with the task ID and the transmission order with the sequence number.

[0055] Benefits: It simplifies invalid data payloads and provides a unique identifier for subsequent permission matching, breakpoint resume, and sequence restoration, avoiding data confusion and difficulty in tracing the source, thus providing a foundation for reliability assurance.

[0056] S3 (Differentiated Packaging)

[0057] Function: Design a dedicated encapsulation format for log files (homogeneous) and data streams (heterogeneous), embedding checksums and authentication information.

[0058] Benefits: Homogeneous data packets compress the protocol header from 20 bytes to 10 bytes, reducing redundancy by 50%; heterogeneous data packets are partitioned and stored according to operation type, reducing internal parsing time by 30%; at the same time, the embedded CRC16 / 32 check bits realize basic integrity detection of data packets, building a solid first line of defense for transmission security.

[0059] S4 (Dynamic MTU Optimization)

[0060] Function: Calculates the optimal packet size using a formula to adapt to the link status.

[0061] Benefits: It avoids the problems of fragmented transmission (large packets) or redundant packet headers (small packets) caused by fixed MTU, and reduces the transmission time of 10GB log from 120 seconds to 75 seconds at 100Mbps bandwidth, greatly improving transmission efficiency, while reducing memory buffer usage by 15%-25%.

[0062] S5 (One-way transmission and decryption verification)

[0063] Function: Physical isolation transmission is achieved through a one-way optical shutter, and the inner end is desealed according to the protocol and performs multi-layer verification.

[0064] Benefits: One-way links physically prevent reverse data backflow, ensuring security in confidential scenarios; multi-layer verification (CRC+MAC+sequential encoding) after decryption can accurately identify tampering, packet loss, and out-of-order issues, increasing data integrity from 95% to 99.9%.

[0065] S6 (Data Synchronization Execution)

[0066] Function: Performs full synchronization of log files, restores the data stream to command execution after matching permissions, and detects sequential encoding and triggers retransmission.

[0067] Benefits: Full synchronization ensures the integrity of the data baseline, incremental command execution enables real-time business operations; permission matching avoids illegal operations, sequential encoding verification and incremental retransmission prevent logical errors such as "insert first, update later", and the consistency error rate is less than 0.01% under 100,000 concurrent operations.

[0068] S7 (Full Sync Coverage)

[0069] Function: Triggers full synchronization and calibrates incremental data through three modes: automatic, manual, and emergency.

[0070] Benefits: Automatic mode adapts to calibration during off-peak business periods, manual mode meets customized needs, and emergency mode provides a backup when the verification failure rate exceeds 5%, eliminating data fragmentation caused by multiple incremental synchronizations and ensuring consistency after large-scale data changes.

[0071] Error recovery mechanism

[0072] Function: Retransmit by task ID and sequence number when timeout / verification fails, record alarms internally and support breakpoint resume.

[0073] Benefits: In extreme environments with a 30% packet loss rate, the packet loss recovery rate is increased to 98%, and the additional bandwidth consumption is reduced by 60%, solving the bandwidth waste problem of full retransmission in traditional solutions.

[0074] Multi-task parallel mechanism

[0075] Function: The external end allocates priority queues according to "system commands > log files > data streams", and the internal multi-threaded parsing is performed according to priority.

[0076] Benefits: It ensures the priority transmission and execution of core system instructions, improves the overall response speed in multi-tasking scenarios, and reduces system resource utilization from 70% to 45% under the same load.

[0077] Based on the above specific embodiments, this invention can be adapted to cross-domain database synchronization scenarios with different levels of confidentiality and business scale. It exhibits differentiated compatibility with existing one-way optical shutter devices, database servers, network security protection equipment, etc., in terms of connection and installation methods and the usage status of each functional structure. Furthermore, it can achieve seamless integration with existing network security protection systems. The following describes typical application scenarios and... Figure 1 Figure 2 The transmission and encapsulation logic will be explained in detail.

[0078] Scenario 1: Synchronization of business databases between classified government intranet and extranet

[0079] 1. Details of connection, installation, and linkage with existing technology devices

[0080] In this scenario, the existing equipment includes an external network government affairs database server, a border firewall, a one-way optical gate device, an internal network classified database server, and a security audit device. The functional modules of this invention are linked and installed with the above-mentioned equipment in the following way:

[0081] The data classification module is embedded in the log output interface of the external government affairs business database server in the form of a lightweight plug-in. It directly collects the full database logs and real-time operation instructions without the need for additional independent hardware deployment, and achieves non-intrusive linkage with the server's log module.

[0082] The protocol stripping module, encapsulation module, and MTU optimization module are integrated into the front-end processing board of the unidirectional optical shutter. The board is connected to the main control board of the optical shutter via a PCI-E interface. The external device is connected to the trusted zone port of the border firewall via an RJ45 interface. The firewall first filters illegal access requests from the external network and then forwards the compliant database data to the external end of the optical shutter, realizing front-end linkage with the existing protection system.

[0083] The deblocking verification module and synchronous execution module of the inner end of the light gate are integrated into the data receiving board on the intranet side. The receiving board is connected to the main control board of the inner end through optical fiber. The inner end device is connected to the confidential database server of the intranet through a dedicated confidential interface. At the same time, the inner end alarm interface is connected to the collection port of the security audit device to realize real-time auditing of error logs.

[0084] Figure 1 The transmit queue and receive queue shown are deployed in the buffer areas at the outer and inner ends of the optical shutter, respectively, forming a linear transmission channel of "queue-link-queue" with the unidirectional transmission link of the optical shutter. Figure 2 The isomorphic packet protocol is embedded in the firmware of the external encapsulation module, supporting immediate use.

[0085] 2. Usage status of each structure

[0086] The data classification module runs continuously, marking the daily full backup data of the external network database as log files and marking real-time citizen business processing operation instructions (such as social security payment and certificate processing) as data streams, and outputting them to the protocol stripping module at a ratio of 1:10.

[0087] After receiving data, the protocol stripping module strips redundant fields of the TCP / IP protocol to generate raw data, marks the log file with task ID01 and the data stream with task ID02, and generates a 6-digit incrementing sequence number according to the receiving order.

[0088] The encapsulation module calls log files. Figure 2 The homogeneous packet protocol sets the packet attribute to 0000000000000010 (the first bit 0 indicates homogeneity, and the last 15 bits indicate the number of packets as 2), and encapsulates it into fixed-block data packets after embedding CRC16 check bits; for data stream calls to heterogeneous packet protocols, it is stored according to INSERT (social security addition), UPDATE (information change), and DELETE (business cancellation), and embeds CRC32 check bits and MAC information generated by SHA-256;

[0089] The MTU optimization module collects link bandwidth (100Mbps) and transmission delay (0.02s) in real time. The optimal MTU value is calculated using the formula 100Mbps / (0.02s×50)=100Mbps. The encapsulated data packets are then adjusted to 1024 bytes / packet to avoid fragmentation.

[0090] The sending queue is prioritized according to "system commands > log files > data streams," with system configuration commands transmitted first at midnight each day, followed by the full log file, and finally the daytime real-time data stream. After receiving data, the receiving queue's decryption and verification module first checks the CRC and MAC information, and then checks... Figure 1 The sequence numbers shown are continuous; if no abnormality is found, the synchronous execution module will be triggered.

[0091] The synchronization module performs a full synchronization of the log files and restores the data stream to SQL command execution after matching permissions. Because the number of requests per second is only 3 for 30 consecutive minutes during the off-peak period of government business at night, the full synchronization mechanism is automatically triggered to complete the data calibration.

[0092] If a data packet times out, the external end will retransmit it according to the task ID 02 and the missing sequence number, and the internal end will simultaneously send an alarm to the security audit device. No manual intervention is required throughout the process.

[0093] Scenario 2: Synchronization of classified R&D databases and production network databases in military industrial units

[0094] 1. Details of connection, installation, and linkage with existing technology devices

[0095] The existing equipment in this scenario includes a classified database server for R&D, a military-grade one-way optical shutter, a production network database server, and a classified data encryption machine. The coordinated installation of the functional modules of this invention has high-level security compatibility characteristics.

[0096] The data classification module is deployed on the encrypted output interface of the classified database server at the R&D end. It works in conjunction with the decryption module of the classified data encryption machine to decrypt the data before classifying it, ensuring that the classified data is encrypted throughout the entire process.

[0097] The protocol stripping module and the encapsulation module are integrated into the electromagnetic leakage protection board at the outer end of the military-grade optical shutter. The board is connected to the outer end of the optical shutter through a military standard interface. The outer end device is connected to the classified switch of the R&D server through optical fiber to achieve physical isolation level linkage.

[0098] The synchronization execution module inside the shutter interfaces with the production instruction scheduling module of the production network database server. The synchronized data is directly pushed to the production scheduling system, realizing the linkage between data synchronization and production instruction issuance.

[0099] Figure 1 The receiving queue is equipped with a classified verification submodule, which is linked with the existing classified data fingerprint database to perform basic verification before performing classified fingerprint comparison.

[0100] 2. Usage status of each structure

[0101] The data classification module marks the full data of weapon and equipment design in the R&D library as log files and the production process adjustment instructions as data streams. The data is first encrypted by an encryption machine and then output to the protocol stripping module.

[0102] The protocol stripping module strips the encryption protocol and transmission protocol, generates encrypted raw data, and marks the task ID01 (log) and ID02 (instruction). Due to the high reliability requirements of military data, the serial number adopts a 12-bit military-grade code.

[0103] Encapsulation module call Figure 2The log file is encapsulated using a homogeneous packet protocol, with a packet count of 10 (the last 15 bits are encoded as 00000000001010). Confidential fingerprint information is embedded in the data content area. The process instructions are encapsulated using a heterogeneous packet protocol and stored in partitions according to INSERT (process addition) and UPDATE (parameter adjustment) to strengthen instruction classification and management.

[0104] The MTU optimization module calculates the optimal MTU value for a military fiber optic link (bandwidth 1000Mbps, latency 0.005s) as 1000Mbps / (0.005s×100)=2000Mbps, adjusting the data packets to 2048 bytes / packet to adapt to high-speed military links.

[0105] The sending queue sets the core parameter instructions of weapons and equipment as the highest priority, taking precedence over log file transmission. After receiving the data, the internal end first performs confidential fingerprint verification, and then performs decryption and data integrity verification.

[0106] Because the failure rate of a certain process instruction verification reached 6%, the emergency mode full synchronization was triggered, and the incremental instructions were overwritten based on the full internal log to ensure that the production data was without deviation.

[0107] The error recovery module, under simulated military complex electromagnetic environment (20% packet loss rate), retransmits according to task ID and sequence number, achieving a packet loss recovery rate of 98% without triggering classified data alarms.

[0108] Scenario 3: Synchronization of a Financial Institution's Core Confidential Account Database with an External Business Database

[0109] 1. Details of connection, installation, and linkage with existing technology devices

[0110] The existing equipment in this scenario includes a core account confidential database, a financial-grade one-way optical shutter, an external business database, and an anti-money laundering monitoring system. The coordinated installation of the modules in this invention must meet the high real-time requirements of financial data.

[0111] The data classification module works in conjunction with the real-time transaction log module of the core account database, and is deployed on the financial cloud platform as a microservice to achieve millisecond-level collection and classification of transaction instructions;

[0112] The protocol stripping and MTU optimization module is integrated into a low-latency processing board at the external end of the financial-grade optical shutter. The board is connected to the business switch of the financial cloud platform through a 10 Gigabit interface and works in conjunction with the front-end acquisition module of the anti-money laundering monitoring system to first complete the anti-money laundering pre-verification of transaction instructions before transmission.

[0113] The synchronization execution module inside the shutter is connected to the account reconciliation module of the external business database. The synchronized data directly triggers the reconciliation process, realizing a closed-loop linkage between synchronization and reconciliation.

[0114] 2. Usage status of each structure

[0115] The data classification module marks the monthly full reconciliation data of the core account as a log file and marks real-time account transaction instructions (such as transfers, deposits and withdrawals) as a data stream, with the transaction instruction collection delay controlled within 5ms;

[0116] The protocol stripping module strips the cloud platform transmission protocol, generates raw data, marks the transaction instruction with task ID02 (high priority), and marks the reconciliation data with ID01. The sequence number is encoded according to the transaction timestamp.

[0117] The encapsulation module calls the heterogeneous packet protocol to encapsulate transaction instructions, partitioning them into INSERT (deposit), UPDATE (transfer), and DELETE (close account). Due to the large number of transaction instructions, the number of packets is set to 20 (the last 15 digits are encoded as 00000000010100). The homogeneous packet protocol is called to encapsulate reconciliation logs, embedding MAC information to ensure that the data cannot be tampered with.

[0118] The MTU optimization module calculates the optimal MTU value for a financial leased line (bandwidth 500Mbps, latency 0.01s) as 500Mbps / (0.01s×80)=625Mbps, which is suitable for the high-concurrency transmission requirements of the leased line.

[0119] The sending queue sets large transaction instructions as the highest priority, taking precedence over ordinary transactions and reconciliation data transmission. After internal verification, the large transaction instructions are restored in real time and executed, triggering anti-money laundering monitoring simultaneously.

[0120] Due to frequent daytime transactions (more than 50 requests per second), automatic full synchronization was not triggered. During the off-peak hours at night (8 requests per second), the automatic mode was triggered to complete the full calibration of the monthly reconciliation data.

[0121] The internal multi-threaded parsing module of the multi-task parallel mechanism starts 8 parsing threads, 4 of which are allocated to transaction instructions, 3 to reconciliation logs, and 1 to system instructions, ensuring parsing efficiency in high-concurrency scenarios and keeping system resource utilization stable within 45%.

[0122] This invention can achieve seamless linkage with existing one-way optical gates, database servers, and security protection equipment through flexible deployment of modules (plugins / boards / microservices) in different scenarios. The usage status of each structure can be dynamically adapted according to link bandwidth, data security level, and business concurrency. It not only retains the physical isolation security characteristics of existing one-way optical gates, but also solves the efficiency and reliability pain points of traditional solutions through differentiated encapsulation, dynamic MTU optimization and other mechanisms, achieving full coverage of different confidential and business scenarios.

[0123] Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be determined by the claims.

Claims

1. A high-performance and high-reliability database security synchronization method based on a one-way optical shutter, characterized in that, Includes the following steps: S1. Divide the database content to be transmitted into two categories: log files and data streams, wherein the log files record the full database data and the data streams are real-time conversions of database operation instructions; S2. After receiving the log file and data stream at the external end of the unidirectional light shutter, the protocol is stripped to generate raw data, and the raw data is marked with a task ID and sequence number. S3. Based on the data type corresponding to the raw data, encapsulate it into homogeneous data packets or heterogeneous data packets. The encapsulation protocol uniformly includes the following structure: the first 2 bytes are packet attributes, which consist of type encoding and quantity encoding; the 3rd-4th bytes are check bits; the 5th-Nth bytes are data content, and this area carries task ID, log summary and message authentication code (MAC) information; S4. Based on the maximum transmission unit (MTU) of the unidirectional optical gate transmission link, dynamically calculate the optimal MTU value and adjust the data packet size accordingly to ensure that the encapsulated data packet does not exceed the optimal MTU value; S5. The encapsulated data packet is transmitted to the internal end through a one-way optical shutter. The internal end decapsulates the data packet according to the preset encapsulation protocol and performs data integrity verification. S6. Perform a full synchronization operation on the log files that have passed the unsealing verification, and restore the data streams that have passed the unsealing verification to database operation instructions according to the task ID they carry and execute the corresponding instructions; S7. After a large-scale data change occurs in the database, a full synchronization mechanism is triggered to ensure data consistency between the internal and external databases.

2. The high-performance and high-reliability database security synchronization method based on one-way optical shutter according to claim 1, characterized in that, In step S3, the specific encapsulation format of the homogeneous data packet is as follows: The first two bytes are packet attributes, where the first bit is the type code, and the type code is set to 0 to identify homogeneous data packets; the next 15 bits are the packet quantity; bytes 3-4 are CRC16 check bits; bytes 5-8 are the original data packet length, used for dynamic allocation of the internal buffer; bytes 9-10 are the task ID, which is used to mark whether the data source is a log file or a data stream; the remaining bytes are the data content, which stores log file data or database operation instructions in fixed blocks.

3. The high-performance and high-reliability database security synchronization method based on one-way optical shutter according to claim 1, characterized in that, In step S3, the specific encapsulation format of the heterogeneous data packet is as follows: The first 2 bytes are packet attributes, where the first bit is the type code, and the type code is set to 1 to identify heterogeneous data packets. The next 15 bits are the number of packets. The 3rd and 4th bytes are CRC32 check bits. The 5th to Nth bytes are the original data packet marking queue. The total length of the marking queue is calculated as (4-byte packet length + 2-byte task ID) × number of merged packets. The data content is divided into storage areas according to the operation type, specifically including INSERT area, UPDATE area and DELETE area. Each area has a 2-byte operation code and a 4-byte data length identifier in the header.

4. The high-performance, high-reliability database security synchronization method based on a unidirectional optical shutter according to claim 1, characterized in that, In step S4, the optimal MTU value is dynamically calculated using the following formula:

5. The high-performance, high-reliability database security synchronization method based on a unidirectional optical shutter according to claim 1, characterized in that, In step S6, the data stream parsing and verification process is as follows: First, based on the task ID carried in the data stream, the corresponding database operation permissions are matched in the pre-stored task list. Second, the SHA-256 algorithm is used to generate a digest, which is then compared with the message authentication code (MAC) carried in the data stream to complete the MAC verification. Finally, the log sequence encoding of the data stream is checked. If a skipped or duplicate encoding is found, an incremental retransmission request is automatically triggered.

6. The high-performance, high-reliability database security synchronization method based on a unidirectional optical shutter according to claim 1, characterized in that, In step S7, the triggering conditions for the full synchronization mechanism include three modes, specifically: Automatic mode: Detects that the database has not been frequently modified for 30 consecutive minutes, and the number of database operation requests per second during this period is less than 10; Manual mode: The administrator manually forces the full synchronization to start; Emergency mode: When the data stream verification failure rate exceeds 5%, it automatically degrades to full synchronization mode.

7. The high-performance, high-reliability database security synchronization method based on a unidirectional optical shutter according to claim 1, characterized in that, The method also includes an error recovery mechanism, specifically: If a data packet experiences a transmission timeout or verification failure, the external end of the one-way light gate will retransmit the lost data packet according to the task ID and sequence number of the data packet; the internal end of the one-way light gate will synchronously record the error log and generate alarm information, while supporting breakpoint resume and incremental synchronization operations.

8. The high-performance, high-reliability database security synchronization method based on a unidirectional optical shutter according to claim 1, characterized in that, The method supports multi-task parallel processing, specifically: The external end of the unidirectional optical shutter assigns an independent sending queue for each task ID, and the priority of the task queue is set according to the task type, with the priority order being system instruction > log file > data stream; the internal end of the unidirectional optical shutter uses multi-threaded parallel parsing of data packets, and the task execution order is sorted according to the queue priority.

Images