One-way data ferrying system and method based on private protocol transmission

Abstract

The invention provides a one-way data ferrying system and method based on private protocol transmission. The system comprises a first host, a data isolation device and a second host, the data isolation device comprises a first processing unit, an isolation island and a second processing unit, the first host is connected with the first processing unit, the first processing unit is connected with the isolation island, the second host is connected with the second processing unit, and the second processing unit is connected with the isolation island; the first host transmits the original data to the first processing unit; the first processing unit peels off a head layer of a protocol stack, encapsulates an application data layer based on a private protocol, and generates a data packet; the first processing unit transmits the data packet to a second processing unit; a second processing unit peels off a head layer of a private protocol in the data packet, extracts application layer data, reconstructs an open TCP / IP protocol stack, and forms a data packet of the TCP / IP protocol stack; and the second processing unit sends the original data to the second host. The problems of low transmission efficiency and low safety during existing one-way data ferrying are solved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a one-way data transfer system and method based on proprietary protocol transmission. Background Technology

[0002] In industries with high information security requirements, such as government, military, and energy, it is necessary to ensure the security of internal network information and prevent external network intrusion and data leakage. However, there is also a need for data transmission between internal and external networks.

[0003] Traditional one-way data transmission requires methods such as CD burning or USB flash drive transfer, which are extremely inefficient and carry a high risk of data loss. Ordinary software transmission methods are also vulnerable to external network intrusion, posing significant risks to internal network information security. Therefore, a highly efficient and reliable one-way data transmission solution is needed. Summary of the Invention

[0004] In view of this, the purpose of this application is to propose a one-way data transfer system and method based on a private protocol, which solves the problems of low transmission efficiency and low security in existing one-way data transfer methods.

[0005] To achieve one of the aforementioned objectives, this application provides a one-way data transfer system based on a proprietary protocol, comprising: First host, data isolation device, and second host; The data isolation device includes a first processing unit, an isolation island, and a second processing unit. The first host is connected to the first processing unit, and the first processing unit can be connected to the isolation island. The second host is connected to the second processing unit, and the second processing unit can be connected to the isolation island. The first host is used to transmit raw data to the first processing unit, and the raw data includes the protocol stack of the open protocol; The first processing unit is used to strip the header layer of the protocol stack and encapsulate the application data layer based on the private protocol to generate a data packet, the data packet including the private protocol identifier; The first processing unit is further configured to transmit the data packet to the second processing unit; The second processing unit is used to strip the header layer of the private protocol from the data packet, extract the application data layer, reconstruct the protocol stack of the open protocol, and restore the original data; The second processing unit is also configured to send the restored original data to the second host.

[0006] As a further improvement to one embodiment of this application, the isolation island includes: One-way transmission module and data transfer module; The first processing unit is used to send a signal to be sent to the data transfer module; The one-way transmission module is used to determine that the first processing unit is connected to the isolation island and the isolation island is disconnected from the second processing unit, and then allows the first processing unit to send the data packet to the isolation island. The data transfer module is used to identify the private protocol identifier and receive the data packet. The data transfer module is used to send the signal to be received to the second processing unit; The one-way transmission module is used to determine that the second processing unit is connected to the isolation island and the isolation island is disconnected from the first processing unit, then the isolation island is allowed to send the data packet to the second processing unit. The second processing unit is used to identify the private protocol identifier and receive the data packet.

[0007] As a further improvement of one embodiment of this application, the first processing unit is connected to the isolation island via a first high-speed serial computer expansion bus standard interface, and the isolation island is connected to the second processing unit via a second high-speed serial computer expansion bus standard interface.

[0008] Based on the same inventive concept, this application also provides a one-way data transfer method based on a proprietary protocol, applied in a one-way data transfer system, the method comprising: The first host transmits the raw data to the first processing unit of the data isolation device, wherein the raw data includes the protocol stack of the open protocol; The first processing unit strips the header layer of the protocol stack and encapsulates the application data layer based on a private protocol to generate a data packet, wherein the data packet encapsulated by the private protocol has a private protocol identifier. The first processing unit transmits the data packet to the second processing unit of the data isolation device; The second processing unit strips the header layer of the private protocol from the data packet, extracts the application data layer, reconstructs the protocol stack of the open protocol, and generates the original data; The second processing unit sends the restored original data to the second host.

[0009] As a further improvement of one embodiment of this application, the second processing unit that transmits the data packet to the data isolation device by the first processing unit includes: The first processing unit sends a signal to be sent to the isolation island of the data isolation device; In response to being connected to the first processing unit and disconnected from the second processing unit, the isolation island allows the first processing unit to send the data packet to the isolation island. After recognizing the private protocol identifier, the isolation island receives the data packet. The isolation island sends a signal to be received to the second processing unit; In response to being connected to the second processing unit and disconnected from the first processing unit, the isolation island is allowed to send the data packet to the second processing unit. After recognizing the private protocol identifier, the second processing unit receives the data packet.

[0010] As a further improvement of one embodiment of this application, the open protocol includes the Internet Protocol Suite, and the protocol stack includes an application data layer, a transmission control protocol header, an Internet Protocol header, and a media access control header. The first host transmits the raw data to the first processing unit of the data isolation device, including: Using the Internet address of the first host as the source address and the virtual address of the first processing unit as the destination address, the first host transmits the original data to the first processing unit via the local area network. Based on the Media Access Control address in the Media Access Control header, the Internet address in the Internet Protocol header, the Open Protocol, the transmission port, and the communication direction, the first processing unit performs comprehensive message filtering to bind the Media Access Control address and the Internet Protocol address.

[0011] As a further improvement to one embodiment of this application, the step of encapsulating the application data layer based on a private protocol to generate data packets includes: The first processing unit fills in the data packet start identifier, data packet length, sequence number, data source information and cyclic redundancy check field according to the format of the private protocol. The data packet start identifier includes the private protocol identifier.

[0012] The second processing unit strips the header layer of the private protocol from the data packet, extracts the application data layer, reconstructs the protocol stack of the open protocol, and generates the original data, including: The second processing unit verifies the data packet start identifier and the verification identifier of the cyclic redundancy check field; The second processing unit strips the header of the proprietary protocol and extracts the application data layer; The second processing unit extracts the data source information from the private protocol, reconstructs the protocol stack of the open protocol, and generates the original data.

[0013] As a further improvement to one embodiment of this application, it also includes: Configure single-bit operation mode; According to the single-bit operation mode, single-bit information is transmitted between the first processing unit and the second processing unit. The single-bit information is used to control the transmission process of the data packets between the first processing unit and the second processing unit.

[0014] As a further improvement to one embodiment of this application, the single-bit operating mode includes: acknowledgment mode, timeout configuration mode, and blocking mode; In the response mode, after the first processing unit transmits the data packet to the second processing unit of the data isolation device, it determines whether the data packet has been successfully transmitted based on the response method of the single-bit information. In the timeout configuration mode, the transmission time of the single-bit information is configured to determine the timeliness of the data packet; In the blocking mode, a threshold for the number of transmissions of the single-bit information is configured. When the number of transmissions exceeds the threshold, the transmission of the first processing unit and the second processing unit is blocked.

[0015] Compared with the prior art, the technical advantages of the present invention are as follows: by stripping the header of the protocol stack of the open protocol and re-encapsulating the header of the private protocol in the application data layer, data is transmitted in the form of a private protocol stack. The private protocol is not disclosed, making it difficult for attackers to exploit vulnerabilities. The private protocol reduces the risk of protocol vulnerability attacks and improves the security and reliability of the data isolation device during unidirectional data transmission. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in this application or related technologies, the drawings used in the description of the implementation methods or related technologies will be briefly introduced below. Obviously, the drawings described below are only the implementation methods of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 A schematic diagram of a one-way data transfer system based on a proprietary protocol provided in one embodiment of this application; Figure 2 A flowchart of a one-way data transfer method based on a proprietary protocol provided in one embodiment of this application; Figure 3 This is a schematic diagram of a private protocol encapsulation provided for another embodiment of this application. Detailed Implementation

[0018] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings. However, these embodiments do not limit the present invention, and any structural, methodological, or functional modifications made by those skilled in the art based on these embodiments are included within the scope of protection of the present invention.

[0019] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by those skilled in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word encompasses the elements or objects listed following the word and their equivalents, without excluding other elements or objects.

[0020] Existing data transfer systems primarily employ two approaches: One is a data isolation device based on a PCI bus interface. This approach uses a PCI bus interface to transfer data between the embedded CPUs on the internal and external networks and the forward secure transmission hardware module. Data is processed by the embedded CPU on the internal network, then transmitted via the PCI bus to the forward secure transmission hardware module, and finally transmitted from the forward secure transmission hardware module to the embedded CPU on the external network via the PCI bus interface. However, the PCI bus interface has a low bandwidth limit, weak anti-interference capability, and poor scalability when performing unidirectional data transmission within the data isolation device, thus limiting the concurrency and transmission rate of the data isolation device.

[0021] Secondly, there's the data isolation device based on transparent data transmission. This technical solution uses a method of truncating TCP connections, stripping the Internet Protocol (IP) header layer from data packets, and sending the pure application data layer of the internal network to the external network through a forward data channel. Simultaneously, it only allows control information in TCP packets containing no data at the application layer to be transmitted to the internal network. However, transparent data transmission has several problems. First, the security protection capability of transparent data transmission is weak. Directly transferring transparent application layer data cannot utilize custom attributes and tags of private protocols for security control, such as adding identity information. Second, the vulnerability handling of transparent data transmission protocols is insufficient. During direct transfer, application layer data is not re-encapsulated by private protocols, making it vulnerable to attacks targeting application layer protocol vulnerabilities. Furthermore, the reliability of transparent data transmission is poor. Direct transfer strips the TCP header layer, losing the TCP protocol's flow control and error recovery mechanisms.

[0022] Thirdly, there is the data isolation device based on the unidirectional optical transmission mechanism. This technical solution uses unidirectional optical fiber interconnection, and the secure island transmission uses a non-network connection. Since both the light source and receiver are unidirectional devices and the transmission of optical signals is directional, a unidirectional physical channel can be built between the transmitting and receiving ends via optical fiber connections to ensure unidirectional transmission of electrical signals on the link. Unidirectional restrictions are implemented in the driver program and application to meet the requirements of completely unidirectional and unidirectional data transmission. However, since the unidirectional optical mechanism is a one-way "blind transmission" without interactive control protocols, data error control is a major problem. The sender does not know whether the receiver has received the data, and the receiver does not know whether the received data is correct. Even if the data is incorrect, it is impossible to make the receiver retransmit it. Therefore, there are some deficiencies in error control.

[0023] To avoid the shortcomings of the prior art, this application provides a one-way data transfer system based on a proprietary protocol, such as... Figure 1 As shown, it includes: a first host, a data isolation device, and a second host; wherein the data isolation device includes a first processing unit, an isolation island, and a second processing unit, the first host is connected to the first processing unit, the first processing unit can be connected to the isolation island, the second host is connected to the second processing unit, and the second processing unit can be connected to the isolation island.

[0024] Specifically, data transfer is a key technology for secure data transmission between internal and external networks. It transfers data from a first host to a second host, but due to physical security factors, the first and second hosts are not directly connected. Instead, a data isolation device is used as a medium for data transmission. The unidirectional data transmission channel of the data isolation device sends the raw data from the first host to the second host, ensuring the security of the first host while achieving automated data transmission and reducing manpower and material costs. The data isolation device includes a first processing unit and a second processing unit for data processing, as well as an isolation island for controlling data transmission and connection switching. Data sent from the first host sequentially passes through the first processing unit, the isolation island, the second processing unit, and the second host.

[0025] It should be noted that a single data transfer is unidirectional; it can be a transfer from the intranet to the extranet or vice versa. In some implementations, the first host is on the extranet and the second host is on the intranet; in other implementations, the first host is on the intranet and the second host is on the extranet.

[0026] In one possible implementation of this application, the three independent boards of the first processing unit, the second processing unit, and the isolation island are integrated into one unit. The circuit boards of the first processing unit and the second processing unit form an independent embedded system to send and receive information, and the middle isolation island is implemented using a dedicated chip.

[0027] In one possible implementation of this application, the first processing unit is connected to the isolation island via a first high-speed serial computer expansion bus standard interface (PCIE interface), and the isolation island is connected to the second processing unit via a second high-speed serial computer expansion bus standard interface (PCIE interface). Utilizing the PCIE interface to achieve high-bandwidth, low-latency data exchange can solve the problems of low efficiency and high concurrency in unidirectional data transmission.

[0028] In one possible implementation of this application, the first host and the first processing unit are connected via a gigabit electrical port or a gigabit optical port; the second host and the second processing unit are connected via a gigabit electrical port or a gigabit optical port.

[0029] In one possible implementation of this application, a first host in a one-way data transfer system transmits raw data to a first processing unit. The raw data includes a protocol stack of an open protocol. The first processing unit strips the header layer of the protocol stack and encapsulates an application data layer based on a private protocol to generate a data packet. The data packet includes a private protocol identifier. The first processing unit transmits the data packet to a second processing unit. The second processing unit strips the header layer of the private protocol from the data packet, extracts the application data layer, reconstructs the protocol stack of the open protocol, and restores the raw data. The second processing unit sends the restored raw data to a second host.

[0030] Specifically, the open protocol stack is the Internet Protocol Suite (TCP / IP) stack. This stack includes the application data layer, Transmission Control Protocol (TCP) header, Internet Protocol (IP) header, and Media Access Header (MAC) header. After stripping away all headers except the application data layer, a proprietary protocol header layer is encapsulated. The data packet with the proprietary protocol header layer is transmitted from the first processing unit to the second processing unit. The second processing unit then strips away the proprietary protocol header layer, recombines the original open protocol header layer with the application data layer, restores the original data, and sends it to the second host, thus achieving the transmission of the original data from the first host to the second host. In this process, the proprietary protocol is not publicly disclosed, making it difficult for attackers to exploit vulnerabilities. Compared to transparent transmission that directly exposes the open protocol, the proprietary protocol reduces the risk of protocol vulnerability attacks.

[0031] In one possible implementation of this application, the isolation island includes a one-way transmission module and a data transfer module; a first processing unit is used to send a signal to be sent to the data transfer module; the one-way transmission module is used to determine that the first processing unit is connected to the isolation island, and that the isolation island is disconnected from the second processing unit, in which case the first processing unit is allowed to send data packets to the isolation island; the data transfer module is used to identify a private protocol identifier and receive data packets; the data transfer module is used to send a signal to be received to the second processing unit; the one-way transmission module is used to determine that the second processing unit is connected to the isolation island, and that the isolation island is disconnected from the first processing unit, in which case the isolation island is allowed to send data packets to the second processing unit; the second processing unit is used to identify a private protocol identifier and receive data packets.

[0032] Specifically, the unidirectional transmission module in the isolation island ensures that the isolation island is not simultaneously connected to the first processing unit and the second processing unit. The first processing unit sends a "data to be sent" signal to the data transfer module. After receiving this signal, the isolation island transmits the data packet to the data buffer of the isolation island via the first high-speed serial computer expansion bus standard interface. After the data packet is received, the first processing unit sends a transmission end signal, and the isolation island immediately disconnects from the first processing unit, awaiting a switchover. Then, the data transfer module sends a "data to be received" signal to the second processing unit, triggering a second hardware switchover. After confirming that the connection with the first processing unit has been disconnected, the unidirectional transmission module connects the second high-speed serial computer expansion bus standard interface from the isolation island to the second processing unit. The isolation island transmits the data packet to the second processing unit via the second high-speed serial computer expansion bus standard interface. After the data packet is sent, the isolation island automatically disconnects from the second processing unit, completing the unidirectional data transmission between different locations.

[0033] Another embodiment of this application discloses a one-way data transfer method based on a proprietary protocol, such as... Figure 2 As shown, it includes: In step S100, the first host transmits the raw data to the first processing unit of the data isolation device. The raw data includes the protocol stack of the open protocol.

[0034] Specifically, when the first motor initiates transmission, the raw data carries the complete protocol stack of the open protocol.

[0035] In one possible implementation of this application, the open protocol includes the Internet Protocol Suite (TCP / IP protocol), and the protocol stack includes the application data layer, the Transmission Control Protocol header (TCP / UDP header), the Internet Protocol header (IP header), and the Media Access Control header (MAC header).

[0036] Step S100 further includes: using the Internet address of the first host as the source address and the virtual address of the first processing unit as the destination address, the first host transmits the raw data to the first processing unit via the local area network.

[0037] Based on the media access control address in the media access control header, the internet address in the internet protocol header, the open protocol, the transmission port, and the communication direction, the first processing unit performs comprehensive message filtering to bind the media access control address and the internet protocol address.

[0038] In step S200, the first processing unit strips the header layer of the protocol stack and encapsulates the application data layer based on the private protocol to generate a data packet, which includes a private protocol identifier.

[0039] Specifically, the first processing unit strips the headers of open protocols from the data. First, it removes the TCP / IP header layer, discarding the original internet address information and media access control addresses, leaving only the application data layer. Then, it encapsulates the private protocol with the application data layer for transmission between the first and second processing units. Only data packets with a recognized private protocol identifier can be transmitted, increasing data transmission security. By utilizing the non-public private protocol, attackers find it difficult to exploit vulnerabilities, reducing the risk of protocol vulnerability attacks.

[0040] In one possible implementation of this application, step S200 includes: The first processing unit fills in the data packet start identifier, data packet length, sequence number, data source information and cyclic redundancy check field (CRC check field) according to the format of the private protocol. The start identifier includes the private protocol identifier.

[0041] Specifically, such as Figure 3As shown, the private protocol encapsulating the application data layer includes a packet start identifier, packet length, sequence number, data source information, and a cyclic redundancy check (CRC) field. The packet start identifier, consisting of four bytes, contains a private protocol identifier. The receiver can only parse the packet after detecting this identifier. Here, the receiver refers to the isolation island receiving packets from the first processing unit and the second processing unit receiving packets from the isolation island. Furthermore, the packet start identifier serves as a fixed identifier, marking the beginning of the packet. The packet length, also four bytes, represents the total length of the packet, used by the receiver to fully define the packet's length and range, preventing packet concatenation during reception due to variable packet sizes. The sequence number, two bytes, records the packet's order information, ensuring the receiver can accurately sort and perform redundancy processing. The data source information includes the address and port information stripped from the Internet Protocol Suite (IPMS) stack, used by the second processing unit to re-encapsulate the data using the IMS stack. The CRC field verifies whether errors have occurred in the transmitted content. If the checksum is inconsistent, the receiver will need to consider discarding the transmitted data or taking redundancy recovery measures. The cyclic redundancy check field in the proprietary protocol can be used in conjunction with integrity checks during transmission to ensure the reliability of data transmission.

[0042] In step S300, the first processing unit transmits the data packet to the second processing unit of the data isolation device.

[0043] In one possible implementation of this application, step S300 includes: In step S310, the first processing unit sends a signal to be sent to the isolation island of the data isolation device.

[0044] In step S320, in response to the isolation island being connected to the first processing unit and disconnected from the second processing unit, the isolation island allows the first processing unit to send data packets to the isolation island. After recognizing the private protocol identifier, the isolation island receives the data packets.

[0045] In step S330, the isolation island sends a signal to be received to the second processing unit.

[0046] In step S340, in response to the isolation island connecting to the second processing unit and disconnecting from the first processing unit, the isolation island is allowed to send data packets to the second processing unit. After the second processing unit recognizes the private protocol identifier, it receives the data packets.

[0047] In step S400, the second processing unit strips the header layer of the private protocol from the data packet, extracts the application data layer, reconstructs the protocol stack of the open protocol, and generates the original data.

[0048] In one possible implementation of this application, step S400 includes: In step S410, the second processing unit verifies the data packet start identifier and the check identifier in the cyclic redundancy check field.

[0049] In step S420, the second processing unit strips the header of the private protocol and extracts the application data layer.

[0050] In step S430, the second processing unit extracts the data source information from the private protocol, reconstructs the protocol stack of the open protocol, and generates the original data.

[0051] Specifically, after receiving the data packet, the second processing unit verifies the packet start identifier and checksum. Once complete, it strips the private protocol header and extracts the application data layer. The second processing unit extracts "data source information," "destination address," and other information from the private protocol to reconstruct the protocol stack (TCP / IP protocol stack) in the original data, i.e., supplementing the IP header, TCP / IP sequence number, etc.

[0052] In step S500, the second processing unit sends the raw data to the second host.

[0053] In one possible implementation of this application, a single-bit signal is transmitted between a first processing unit and a second processing unit to generate an acknowledgment signal and an acknowledgment type.

[0054] The one-way data transfer method based on proprietary protocols also includes: Step S601: Configure single-bit operation mode; Step S602: In single-bit operation mode, single-bit information is transmitted between the first processing unit and the second processing unit. The single-bit information is used to control the transmission process of data packets between the first processing unit and the second processing unit.

[0055] Specifically, a global single-bit configuration function is added to the data isolation device. This global single-bit configuration function is adapted to the selectable response mechanism for single-bit information, enabling data interaction control between the first processing unit and the second processing unit.

[0056] In one possible implementation of this application, the single-bit operation mode includes an acknowledgment mode. In the acknowledgment mode, after the first processing unit transmits the data packet to the second processing unit, it determines whether the data packet has been successfully transmitted based on the acknowledgment method of the single-bit information.

[0057] Specifically, the response modes include no response mode, single response FF mode, single response 00 mode, and dual response mode. The no-response mode refers to the second processing unit receiving data from the first processing unit without sending any single-bit response information. This mode is suitable for business scenarios where data reception status confirmation is not required. The single-response FF mode refers to the second processing unit receiving data and verifying its accuracy before sending a single-bit "FF" response to the first processing unit. This response indicates that the data packet was successfully received and its integrity meets the requirements. The single-response 00 mode refers to the second processing unit receiving data and sending a single-bit "00" response to the first processing unit. This response indicates a specific indication of the data reception or processing status. The double-response mode refers to the second processing unit receiving data and sending two single-bit response messages to the first processing unit in stages. The first response indicates confirmation of data reception, and the second response indicates confirmation of data processing results. This mode is suitable for business scenarios that require phased feedback of interaction status. After the first processing unit completes the data transmission operation to the second processing unit, the second processing unit will send a single-bit response message of the corresponding type to the first processing unit according to the above-mentioned preset response modes. Different types of single-bit response messages carry different interactive meanings to adapt to diverse business communication needs.

[0058] In one possible implementation of this application, the single-bit operation mode includes a timeout configuration mode, in which the transmission time of single-bit information is configured to determine the timeliness of data packets.

[0059] Specifically, the timeout configuration is used to set the response packet return time corresponding to the data packet. Users can flexibly adjust the response packet return time limit parameter according to the actual business processing characteristics, data transmission link conditions and communication latency requirements to ensure the timeliness and controllability of the data interaction process.

[0060] In one possible implementation of this application, the single-bit operation mode includes a blocking mode. In the blocking mode, a threshold for the number of single-bit information transmissions is configured. When the number of transmissions exceeds the threshold, the transmissions of the first processing unit and the second processing unit are blocked.

[0061] Specifically, the blocking mode is associated with the single-bit anomaly number monitoring mechanism. A single-bit anomaly number threshold is pre-configured. When the detected single-bit anomaly number reaches or exceeds the preset threshold, if the blocking mode is in the enabled state, the blocking operation of the corresponding strategy is triggered. If the blocking mode is in the disabled state, the corresponding strategy does not execute the blocking operation. Through the above multi-dimensional configuration, precise control of single-bit control information interaction is achieved, effectively improving the operational security, stability and adaptability of the data isolation device.

[0062] Based on the same inventive concept, corresponding to any of the above-described embodiments, this application also provides a non-transitory computer-readable storage medium that stores computer instructions for causing the computer to execute the one-way data transfer method based on a proprietary protocol as described in any of the above embodiments.

[0063] The computer-readable medium in this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device.

[0064] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to execute the one-way data transfer method based on the private protocol as described in any of the above embodiments, and have the beneficial effects of the corresponding method implementation, which will not be repeated here.

[0065] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of this application (including the claims) is limited to these examples; this manner of description is merely for clarity, and those skilled in the art should consider the specification as a whole. Within the framework of this application, the above embodiments or the technical features of different embodiments can also be appropriately combined, the steps can be implemented in any order, and there are many other variations of different aspects of the embodiments of this application as described above, which are not provided in the details for the sake of brevity.

[0066] Additionally, to simplify the description and discussion, and to avoid obscuring the embodiments of this application, the well-known power / ground connections to integrated circuit (IC) chips and other components may or may not be shown in the provided drawings. Furthermore, the apparatus may be shown in block diagram form to avoid obscuring the embodiments of this application, and this also takes into account the fact that the details of the implementation of these block diagram apparatuses are highly dependent on the platform on which the embodiments of this application will be implemented (i.e., these details should be entirely within the understanding of those skilled in the art). While specific details (e.g., circuits) are set forth to describe exemplary embodiments of this application, it will be apparent to those skilled in the art that the embodiments of this application can be implemented without these specific details or with variations thereof. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0067] Although this application has been described in conjunction with specific embodiments thereof, many substitutions, modifications, and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the embodiments discussed.

[0068] The embodiments described herein are intended to cover all such substitutions, modifications, and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc., made without departing from the spirit and principles of the embodiments described herein should be included within the protection scope of this application.

Claims

1. A one-way data ferry system based on private protocol transmission, characterized in that, include: First host, data isolation device, and second host; The data isolation device includes a first processing unit, an isolation island, and a second processing unit. The first host is connected to the first processing unit, and the first processing unit can be connected to the isolation island. The second host is connected to the second processing unit, and the second processing unit can be connected to the isolation island. The first host is used to transmit raw data to the first processing unit, and the raw data includes the protocol stack of the open protocol; The first processing unit is used to strip the header layer of the protocol stack and encapsulate the application data layer based on the private protocol to generate a data packet, the data packet including the private protocol identifier; The first processing unit is further configured to transmit the data packet to the second processing unit; The second processing unit is used to strip the header layer of the private protocol from the data packet, extract the application data layer, reconstruct the protocol stack of the open protocol, and restore the original data; The second processing unit is also configured to send the restored original data to the second host.

2. The unidirectional data pivoting system based on private protocol transmission of claim 1, wherein, The isolation island includes: One-way transmission module and data transfer module; The first processing unit is used to send a signal to be sent to the data transfer module; The one-way transmission module is used to determine that the first processing unit is connected to the isolation island and the isolation island is disconnected from the second processing unit, and then allows the first processing unit to send the data packet to the isolation island. The data transfer module is used to identify the private protocol identifier and receive the data packet. The data transfer module is used to send the signal to be received to the second processing unit; The one-way transmission module is used to determine that the second processing unit is connected to the isolation island and the isolation island is disconnected from the first processing unit, then the isolation island is allowed to send the data packet to the second processing unit. The second processing unit is used to identify the private protocol identifier and receive the data packet.

3. The unidirectional data pivoting system based on private protocol transmission of claim 1, wherein, The first processing unit is connected to the isolation island via a first high-speed serial computer expansion bus standard interface, and the isolation island is connected to the second processing unit via a second high-speed serial computer expansion bus standard interface.

4. A one-way data ferrying method based on private protocol transmission, characterized in that, Applied to the unidirectional data transfer system as described in any one of claims 1-3, the method comprises: The first host transmits the raw data to the first processing unit of the data isolation device, wherein the raw data includes the protocol stack of the open protocol; The first processing unit strips the header layer of the protocol stack and encapsulates the application data layer based on a private protocol to generate a data packet. The data packet encapsulated by the private protocol includes a private protocol identifier. The first processing unit transmits the data packet to the second processing unit of the data isolation device; The second processing unit strips the header layer of the private protocol from the data packet, extracts the application data layer, reconstructs the protocol stack of the open protocol, and generates the original data; The second processing unit sends the restored original data to the second host.

5. The unidirectional data pivoting method based on private protocol transmission according to claim 4, characterized in that, The first processing unit transmits the data packet to the second processing unit of the data isolation device, which includes: The first processing unit sends a signal to be sent to the isolation island of the data isolation device; In response to being connected to the first processing unit and disconnected from the second processing unit, the isolation island allows the first processing unit to send the data packet to the isolation island. After recognizing the private protocol identifier, the isolation island receives the data packet. The isolation island sends a signal to be received to the second processing unit; In response to being connected to the second processing unit and disconnected from the first processing unit, the isolation island is allowed to send the data packet to the second processing unit. After recognizing the private protocol identifier, the second processing unit receives the data packet.

6. The unidirectional data pivoting method based on private protocol transmission according to claim 4, characterized in that, The open protocol includes the Internet Protocol Suite, and the protocol stack includes the application data layer, the transmission control protocol header, the Internet Protocol header, and the media access control header. The first host transmits the raw data to the first processing unit of the data isolation device, including: Using the Internet address of the first host as the source address and the virtual address of the first processing unit as the destination address, the first host transmits the original data to the first processing unit via the local area network. Based on the Media Access Control address in the Media Access Control header, the Internet address in the Internet Protocol header, the Open Protocol, the transmission port, and the communication direction, the first processing unit performs comprehensive message filtering to bind the Media Access Control address and the Internet Protocol address.

7. The unidirectional data pivoting method based on private protocol transmission according to claim 5, characterized in that, The process of encapsulating application data layers based on private protocols to generate data packets includes: The first processing unit fills in the data packet start identifier, data packet length, sequence number, data source information and cyclic redundancy check field according to the format of the private protocol. The data packet start identifier includes the private protocol identifier.

8. The unidirectional data pivoting method based on private protocol transmission according to claim 7, characterized in that, The second processing unit strips the header layer of the private protocol from the data packet, extracts the application data layer, reconstructs the protocol stack of the open protocol, and generates the original data, including: The second processing unit verifies the data packet start identifier and the verification identifier of the cyclic redundancy check field; The second processing unit strips the header of the proprietary protocol and extracts the application data layer; The second processing unit extracts the data source information from the private protocol, reconstructs the protocol stack of the open protocol, and generates the original data.

9. The unidirectional data pivoting method based on private protocol transmission according to claim 4, characterized in that, Also includes: Configure single-bit operation mode; According to the single-bit operation mode, single-bit information is transmitted between the first processing unit and the second processing unit. The single-bit information is used to control the transmission process of the data packets between the first processing unit and the second processing unit.

10. The unidirectional data pivoting method based on private protocol transmission according to claim 9, characterized in that, The single-bit operating modes include: acknowledgment mode, timeout configuration mode, and blocking mode; In the response mode, after the first processing unit transmits the data packet to the second processing unit, it determines whether the data packet was successfully transmitted based on the response method of the single-bit information. In the timeout configuration mode, the transmission time of the single-bit information is configured to determine the timeliness of the data packet; In the blocking mode, a threshold for the number of transmissions of the single-bit information is configured. When the number of transmissions exceeds the threshold, the transmission of the first processing unit and the second processing unit is blocked.

Images