A system, method, apparatus, processor, and computer-readable storage medium thereof for achieving one-way data transmission based on message feature recognition.

Abstract

This invention relates to a system for enabling one-way data transmission based on message feature recognition. The system includes an encrypted message feature recognition module, an unencrypted message traffic desensitization module, a traffic message splitting and transmission module, and a message blocking module. The encrypted message feature recognition module identifies and classifies encrypted messages into communication messages and data messages. The unencrypted message traffic desensitization module deconstructs, desensitizes, constructs, and transmits unencrypted messages. The traffic message splitting and transmission module identifies and separates traffic messages. The message blocking module identifies and blocks data messages flowing from high-security-requirement-to-low-security-requirement-receiver data messages. The system, method, apparatus, processor, and computer-readable storage medium of this invention, based on message feature recognition for enabling one-way data transmission, effectively provide security boundary protection for one-way data transmission scenarios, and provide support and assurance for exploring more new business scenarios and services.

Description

Technical Field

[0001] This invention relates to the field of data security, and more particularly to the field of network boundary protection. Specifically, it refers to a system, method, apparatus, processor, and computer-readable storage medium thereof that enables one-way data flow based on message feature recognition. Background Technology

[0002] Similar products to the data one-way passage technology research based on message feature recognition presented in this paper include optical gateways and network gateways. The optical gateway, abbreviated as FGAP, is a unidirectional isolation hardware and software system based on optical properties, developed from the security isolation gateway (GAP). If a high-security storage network is logically isolated from the internet, a unidirectional gateway is used to isolate the high-security storage network from the low-security storage network, ensuring that high-security data does not flow from the high-security-requirement network to the low-security-requirement network. The optical gateway can extract and convert data into a format suitable for unidirectional transmission before transmitting it unidirectionally. However, the optical gateway cannot perform two-way authentication of the TLS protocol, nor can it achieve unidirectional file transfer based on two-way authentication. The network gateway (GAP), also known as a network isolation gateway, is a network security device used to achieve physical or logical isolation between two or more networks to ensure the security of information flow. The gateway can store information in two independent networks according to different information storage security requirements. The internal and external networks are physically disconnected, thereby protecting data security. However, due to its inherent characteristics, the network gateway has some fatal flaws: it can only support static data exchange and cannot support interactive access. Furthermore, the network gateway has a narrow scope of application, cannot realize the complete ISO / OSI seven-layer connection process, has poor flexibility, and a limited range of applications. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the prior art and provide a system, method, apparatus, processor and computer-readable storage medium for achieving one-way data release based on message feature recognition, which is flexible, widely applicable and has a wide range of applications.

[0004] To achieve the above objectives, the present invention provides a system, method, apparatus, processor, and computer-readable storage medium for realizing one-way data release based on message feature recognition, as follows: The main feature of this system for achieving one-way data transmission based on message feature recognition is that the system includes: The system includes an encrypted message feature recognition module, an unencrypted message traffic desensitization module, a traffic message splitting and transmission module, and a message blocking module. The output of the encrypted message feature recognition module is connected to the traffic message splitting transmission module and the message blocking module; the output of the unencrypted message traffic desensitization module is connected to the message blocking module; and the output of the traffic message splitting transmission module is connected to the message blocking module. The encrypted message feature recognition module is used to perform feature recognition on encrypted messages. By parsing the quintuple and learning and analyzing the attributes of the message itself, it identifies and classifies communication messages and data messages. The unencrypted message traffic desensitization module is used to deconstruct, desensitize, construct, and send unencrypted messages. The aforementioned traffic packet splitting transmission module is used to identify and separate traffic packets, and to split and transmit traffic and control splitting strategies. The packet blocking module is used to identify and block data packets flowing from high storage security requirements to low storage security requirements.

[0005] Preferably, the encrypted message feature recognition module parses the protocol identifier, port number, and encryption identifier fields in the message header to preliminarily determine the encryption type; it extracts information such as the fixed feature code and encryption block length of the message payload and matches them with a preset encryption protocol feature library to classify communication messages and data messages.

[0006] Preferably, the unencrypted message traffic desensitization module maintains sensitive information fields and desensitization rules based on a configuration file, and supports two desensitization modes: fuzzy matching and precise matching. If an unencrypted message flows in, the unencrypted message traffic desensitization module disassembles the message data segment, matches sensitive fields using regular expressions, and performs replacement, masking, or truncation processing on the matched fields to reconstruct the message format.

[0007] Preferably, the traffic packet splitting transmission module has built-in dual transmission channels, corresponding to the flow directions of "low storage security requirements to high storage security requirements" and "high storage security requirements to low storage security requirements" respectively; the packets are allocated to the corresponding channels based on the classification results and domain identification information output by the packet feature recognition module.

[0008] Preferably, the message blocking module monitors the flow channel from "high storage security requirements to low storage security requirements" in real time. If a data packet is detected, the blocking mechanism is triggered, the current packet is discarded, and a link termination signal is sent. If a communication handshake packet is detected, the packet is allowed to pass normally.

[0009] The main feature of this method for achieving one-way data release based on message feature recognition is that the method includes the following steps: (1) Access the bidirectional protocol data stream, filter invalid packets and execute standardized formats; (2) Identify the encryption status of the message, perform feature identification on the encrypted message to distinguish between communication messages and data messages, and mark the storage security requirements of the unencrypted message; (3) De-identify sensitive information fields in unencrypted messages according to preset de-identification rules; (4) Assign the message to the corresponding transmission channel of "low storage security requirement to high storage security requirement" or "high storage security requirement to low storage security requirement", and mark the flow information; (5) Allow all packets flowing from “low storage security requirements to high storage security requirements”, block data packets flowing from “high storage security requirements to low storage security requirements”, and allow communication packets flowing in that direction.

[0010] Preferably, step (2) specifically includes: The protocol identifier, port number, and encryption identifier fields in the message header are parsed to preliminarily determine the encryption type; information such as the fixed feature code and encryption block length of the message payload is extracted and matched with a preset encryption protocol feature library to classify communication messages and data messages.

[0011] Preferably, step (3) specifically includes: If an unencrypted message is detected, the unencrypted message traffic desensitization module will disassemble the message data segment, match sensitive fields using regular expressions, and perform replacement, masking, or truncation on the matched fields to reconstruct the message format.

[0012] Preferably, in step (5), the blocking response time for the data packets flowing from "high storage security requirements to low storage security requirements" does not exceed 1ms, and the communication handshake packets of this flow are retained and allowed to pass.

[0013] Preferably, the method further includes the following steps: Record and audit the logs, including the identification results, flow, processing actions, and timestamps of each message.

[0014] The main feature of this device for achieving one-way data release based on message feature recognition is that the device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the above-described method for achieving one-way data release based on message feature recognition.

[0015] The processor for implementing one-way data release based on message feature recognition is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the above-mentioned method for implementing one-way data release based on message feature recognition are implemented.

[0016] The main feature of this computer-readable storage medium is that it stores a computer program thereon, which can be executed by a processor to implement the various steps of the above-described method for achieving one-way data release based on message feature recognition.

[0017] The system, method, apparatus, processor, and computer-readable storage medium of the present invention, which implement unidirectional data transmission based on message feature recognition, are developed for data security protection needs in business scenarios based on bidirectional protocols between high and low storage security requirements. This bidirectional protocol-based unidirectional data isolation device is expected to effectively provide security boundary protection for business scenarios requiring unidirectional data transmission, such as database synchronization and video streaming, becoming the cornerstone of data security for various businesses and providing support and protection for exploring more new business scenarios and services. Attached Figure Description

[0018] Figure 1 This is a schematic diagram illustrating the technical content of the system for achieving one-way data release based on message feature recognition according to the present invention.

[0019] Figure 2 This is a data transmission diagram illustrating the method for achieving one-way data release based on message feature recognition according to the present invention. Detailed Implementation

[0020] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.

[0021] The system for one-way data release based on message feature recognition of the present invention includes: The system includes an encrypted message feature recognition module, an unencrypted message traffic desensitization module, a traffic message splitting and transmission module, and a message blocking module. The output of the encrypted message feature recognition module is connected to the traffic message splitting transmission module and the message blocking module; the output of the unencrypted message traffic desensitization module is connected to the message blocking module; and the output of the traffic message splitting transmission module is connected to the message blocking module. The encrypted message feature recognition module is used to perform feature recognition on encrypted messages. By parsing the quintuple and learning and analyzing the attributes of the message itself, it identifies and classifies communication messages and data messages. The unencrypted message traffic desensitization module is used to deconstruct, desensitize, construct, and send unencrypted messages. The aforementioned traffic packet splitting transmission module is used to identify and separate traffic packets, and to split and transmit traffic and control splitting strategies. The packet blocking module is used to identify and block data packets flowing from high storage security requirements to low storage security requirements.

[0022] In a preferred embodiment of the present invention, the encrypted message feature recognition module parses the protocol identifier, port number, and encryption identifier fields in the message header to preliminarily determine the encryption type; it extracts information such as the fixed feature code and encryption block length of the message payload and matches them with a preset encryption protocol feature library to classify communication messages and data messages.

[0023] In a preferred embodiment of the present invention, the unencrypted message traffic desensitization module maintains sensitive information fields and desensitization rules based on a configuration file, and supports two desensitization modes: fuzzy matching and precise matching. If an unencrypted message flows in, the unencrypted message traffic desensitization module disassembles the message data segment, matches sensitive fields using regular expressions, and performs replacement, masking, or truncation processing on the matched fields to reconstruct the message format.

[0024] In a preferred embodiment of the present invention, the traffic packet splitting transmission module has built-in dual transmission channels, which correspond to the flow directions of "low storage security requirements to high storage security requirements" and "high storage security requirements to low storage security requirements" respectively; the packets are allocated to the corresponding channels by the classification results and domain identification information output by the packet feature recognition module.

[0025] In a preferred embodiment of the present invention, the packet blocking module monitors the flow channel from "high storage security requirements to low storage security requirements" in real time. If a data packet is detected, the blocking mechanism is triggered, the current packet is discarded and a link termination signal is sent; if a communication handshake packet is detected, the packet is allowed to pass normally.

[0026] The present invention discloses a method for achieving one-way data release based on message feature recognition, wherein the method includes the following steps: (1) Access the bidirectional protocol data stream, filter invalid packets and execute standardized formats; (2) Identify the encryption status of the message, perform feature identification on the encrypted message to distinguish between communication messages and data messages, and mark the storage security requirements of the unencrypted message; (3) De-identify sensitive information fields in unencrypted messages according to preset de-identification rules; (4) Assign the message to the corresponding transmission channel of "low storage security requirement to high storage security requirement" or "high storage security requirement to low storage security requirement", and mark the flow information; (5) Allow all packets flowing from “low storage security requirements to high storage security requirements”, block data packets flowing from “high storage security requirements to low storage security requirements”, and allow communication packets flowing in that direction.

[0027] In a preferred embodiment of the present invention, step (2) specifically comprises: The protocol identifier, port number, and encryption identifier fields in the message header are parsed to preliminarily determine the encryption type; information such as the fixed feature code and encryption block length of the message payload is extracted and matched with a preset encryption protocol feature library to classify communication messages and data messages.

[0028] In a preferred embodiment of the present invention, step (3) specifically comprises: If an unencrypted message is detected, the unencrypted message traffic desensitization module will disassemble the message data segment, match sensitive fields using regular expressions, and perform replacement, masking, or truncation on the matched fields to reconstruct the message format.

[0029] In a preferred embodiment of the present invention, the blocking response time of the data packet flowing from "high storage security requirement to low storage security requirement" in step (5) does not exceed 1ms, and the communication handshake packet of this flow is retained and allowed.

[0030] In a preferred embodiment of the present invention, the method further includes the following steps: Record and audit the logs, including the identification results, flow, processing actions, and timestamps of each message.

[0031] The device for achieving one-way data release based on message feature recognition of the present invention includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the above-described method for achieving one-way data release based on message feature recognition.

[0032] The processor of the present invention for realizing one-way data release based on message feature recognition is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the above-described method for realizing one-way data release based on message feature recognition are implemented.

[0033] The present invention relates to a computer-readable storage medium having a computer program stored thereon, the computer program being executable by a processor. This invention addresses the shortcomings of existing protection measures for data security boundaries in business scenarios based on bidirectional protocols between high and low storage security requirements, including significant drawbacks, insufficient protection effectiveness, and difficulties in business implementation. It focuses on improving the real-time protection capability of unidirectional data security boundaries between data areas with high and low storage security requirements. The main objective of this invention is to enhance the unidirectional data transmission security capability of security boundaries between high and low-level data areas.

[0034] The content of this invention is as follows Figure 1 As shown, firstly, an encrypted message feature recognition module is studied to provide underlying guarantees for encrypted message data packet recognition, decoupling transmission, and unidirectional control. Simultaneously, an unencrypted message traffic desensitization module is studied to improve device robustness and minimize the impact on services. Then, a traffic packet decoupling transmission module and a packet blocking module are studied to achieve unidirectional control of data traffic packets under a bidirectional protocol, while ensuring bidirectional communication. These steps are then implemented to achieve the aforementioned method for unidirectional data transmission based on message feature recognition.

[0035] The present invention provides a one-way data release device based on message feature recognition, comprising an encrypted message feature recognition module, an unencrypted message traffic desensitization module, a traffic message splitting transmission module, and a message blocking module. The modules work together to achieve one-way data release at the security boundary under the bidirectional protocol with high and low storage security requirements.

[0036] The encrypted message feature recognition module, when faced with encrypted messages and other traffic messages, adopts a feature recognition method for encrypted messages. It identifies messages by parsing the five-tuple and learning and analyzing the attributes of the message itself, so as to classify them into communication messages and data messages.

[0037] The unencrypted message traffic desensitization module uses a recovery technique that involves disassembling, desensitizing, constructing, and sending unencrypted messages to desensitize the message content, thereby minimizing the impact on services.

[0038] The traffic packet splitting transmission module, based on packet feature recognition technology, identifies and separates traffic packets, and performs splitting transmission and splitting strategy control on the traffic.

[0039] The packet blocking module is based on packet feature recognition technology and ACK packets (TCP traffic blocking packets). It can intercept packets and block communication when it detects that data packets are flowing from high storage security requirements to low storage security requirements.

[0040] The encrypted message feature recognition module classifies encrypted messages into communication messages and data messages through message header parsing, encryption protocol feature extraction, and data payload feature analysis, providing underlying support for subsequent modules.

[0041] The unencrypted message traffic desensitization module uses a configuration file to maintain sensitive information fields and desensitization rules, and performs a recovery-style processing of "disassembly-desensitization-construction-sending" to reduce the impact on business.

[0042] The traffic packet splitting transmission module constructs dual transmission channels based on packet classification results and storage security requirements, realizing targeted traffic allocation and ensuring compatibility between bidirectional communication establishment and unidirectional data control.

[0043] The message blocking module performs interception and communication blocking operations on data packets flowing from "high to low", while allowing packets flowing from "low to high" to pass normally, preventing data backflow.

[0044] A method for unidirectional data release based on message feature recognition, using any of the aforementioned devices, includes the following steps: (1) Message access and preprocessing: Access bidirectional protocol data stream, filter invalid messages and standardize format; (2) Message feature identification and classification: Identify the encryption status of messages, classify encrypted messages, and mark the ownership information of unencrypted messages; (3) De-identification of unencrypted messages: De-identify unencrypted messages and then allow them to pass; (4) Traffic routing and direction determination: Distribute messages to the corresponding flow channels and mark the flow information; (5) One-way release and blocking control: release “low→high” flow messages and block “high→low” flow data messages.

[0045] In step (2), a dual mechanism of "header parsing + feature matching" is used to identify encrypted messages, with an accuracy rate of no less than 90% and a processing delay of no more than 1ms.

[0046] Step (3) supports two desensitization modes: fuzzy matching and precise matching. The desensitization processing delay is no more than 2ms.

[0047] In step (5), the blocking response time does not exceed 1ms, and the handshake message of the bidirectional protocol communication link is retained to ensure the continuous establishment of the link.

[0048] The method also includes logging and auditing steps, recording message processing logs, supporting querying and audit analysis, and enabling traceability of operations.

[0049] The following embodiments are used to illustrate the present invention, but do not limit the scope of the present invention.

[0050] (a) Equipment hardware deployment The device produced by the data one-way release technology based on message feature recognition described in this invention is deployed at the security boundary between high and low storage security requirements. The hardware adopts a multi-core processor architecture and supports mainstream bidirectional protocols such as TCP / IP, database synchronization protocols, and video transmission protocols. The device has a built-in encryption algorithm library and a de-identification rule configuration module, allowing for flexible configuration of sensitive fields, de-identification strategies, and flow control rules through a management interface.

[0051] (II) Implementation Details of Core Modules 1. Encrypted message feature recognition module This module adopts a dual identification mechanism of "header parsing + feature matching": first, it parses the protocol identifier, port number, and encryption identifier fields in the message header to preliminarily determine the encryption type; then, it extracts information such as the fixed feature code and encryption block length of the message payload and matches them with the preset encryption protocol feature library to achieve the classification of communication messages and data messages.

[0052] 2. Unencrypted message traffic desensitization module The module maintains a list of sensitive information fields (such as ID card numbers, mobile phone numbers, and core business data fields) based on configuration files, and supports both fuzzy matching and exact matching de-identification modes. When an unencrypted message enters, the module disassembles the message data segment, matches sensitive fields using regular expressions, performs replacement, masking, or truncation on the matched fields, and then reconstructs the message format to ensure that the de-identified message conforms to business protocol specifications.

[0053] 3. Traffic Message Splitting Transmission Module The module has built-in dual transmission channels, corresponding to "low→high" and "high→low" flows respectively. Based on the classification results and domain identification information output by the message feature recognition module, messages are assigned to the corresponding channels; simultaneously, handshake messages for the bidirectional protocol communication link are maintained to ensure continuous link establishment, achieving parallel compatibility between unidirectional data transmission and bidirectional communication.

[0054] 4. Message blocking module The module monitors the packets flowing from "high" to "low" in real time. When a data packet is detected, the blocking mechanism is immediately triggered, the current packet is discarded and a link termination signal is sent to prevent subsequent data transmission. Communication handshake packets are allowed to pass normally to ensure the link continues.

[0055] (III) Implementation of the complete workflow 1) System initialization: After the device starts up, it completes the loading of the protocol library, configuration of the desensitization rules and channel initialization, establishes a network connection with high and low storage security requirements, and initializes the bidirectional protocol communication link; 2) Message access processing: The bidirectional protocol data stream access device has a preprocessing module that filters invalid messages and standardizes the format of valid messages; 3) Message identification and desensitization: Encrypted messages are classified by the feature identification module, and unencrypted messages are processed by the desensitization module before entering the split transmission module; 4) Routing and Flow Direction Determination: The routing module allocates packets to the corresponding flow channels and marks the flow direction information; 5) One-way control execution: "Low → High" flow packets are allowed to pass normally, while "High → Low" flow packets are blocked, realizing one-way data passage; 6) Logs and Audits: The device records all message processing logs (including identification results, flow direction, processing actions, etc.), supports log query and audit analysis, and ensures that operations are traceable.

[0056] For the primary path, communication packets returning from the secondary path in response to traffic packets from the primary path can pass through the secondary path normally. If data traffic passes through the secondary path, it will be intercepted by the device, thus triggering a transmission anomaly and interrupting the flow of data from high-security-requirement to low-security-requirement devices. For unencrypted messages, deep packet inspection (DPI) and traffic signature analysis techniques are used to identify data packets and communication packets. After identification, data traffic from high-security-requirement devices to low-security-requirement devices is intercepted. For plaintext protocols, data traffic is discarded, and TCP packets are forged to maintain protocol integrity; for secure encrypted protocols, blocking methods are used to ensure data security.

[0057] This invention aims to address the security of unidirectional data exchange in bidirectional protocol scenarios between high and low-level data domains, ensuring the security of data flow from low-level to high-level, intercepting data backflow from high-level to low-level, and maintaining the normal communication establishment of bidirectional protocols.

[0058] The core of this invention is to achieve encrypted message feature recognition, unencrypted message desensitization, traffic message splitting transmission, and high-to-low data message directional blocking. The core is active data flow control, rather than passive status monitoring.

[0059] The unidirectional technology of this invention is an active control in the actual data transmission link. It maintains the interaction of bidirectional communication messages based on message feature recognition, and only performs unidirectional opening / blocking of data traffic messages. It involves the maintenance of bidirectional protocols and the directional control of data flow.

[0060] This invention deals with traffic packets that cross high and low level data domains and are based on a bidirectional protocol. The scenario is security protection of the high-level data domain, which needs to balance smooth business operations and one-way data control.

[0061] The one-way release of this invention is for the flow control of high and low level data domains. The one-way data release of this invention is an active transmission link control, the purpose of which is to realize the directional management and control of data flow between high and low level data domains.

[0062] The one-way release of this invention is based on the maintenance of bidirectional protocol communication, and involves the one-way control of data traffic, including the normal interaction of bidirectional communication messages and the one-way transmission of data messages.

[0063] This invention is based on encrypted message feature recognition technology and combined with unencrypted message desensitization technology. It achieves isolation of communication / data messages through split transmission and targeted interception of high-to-low data messages through message blocking. It is a synergistic combination of multiple innovative technologies.

[0064] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.

[0065] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.

[0066] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.

[0067] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.

[0068] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0069] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0070] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0071] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.

[0072] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0073] The system, method, apparatus, processor, and computer-readable storage medium of the present invention, which implement unidirectional data transmission based on message feature recognition, are developed for data security protection needs in business scenarios based on bidirectional protocols between high and low storage security requirements. This bidirectional protocol-based unidirectional data isolation device is expected to effectively provide security boundary protection for business scenarios requiring unidirectional data transmission, such as database synchronization and video streaming, becoming the cornerstone of data security for various businesses and providing support and protection for exploring more new business scenarios and services.

[0074] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.

Claims

1. A system for achieving one-way data release based on message feature recognition, characterized in that, The system includes: The system includes an encrypted message feature recognition module, an unencrypted message traffic desensitization module, a traffic message splitting and transmission module, and a message blocking module. The output of the encrypted message feature recognition module is connected to the traffic message splitting transmission module and the message blocking module; the output of the unencrypted message traffic desensitization module is connected to the message blocking module; and the output of the traffic message splitting transmission module is connected to the message blocking module. The encrypted message feature recognition module is used to perform feature recognition on encrypted messages. By parsing the quintuple and learning and analyzing the attributes of the message itself, it identifies and classifies communication messages and data messages. The unencrypted message traffic desensitization module is used to deconstruct, desensitize, construct, and send unencrypted messages. The aforementioned traffic packet splitting transmission module is used to identify and separate traffic packets, and to split and transmit traffic and control splitting strategies. The packet blocking module is used to identify and block data packets flowing from high storage security requirements to low storage security requirements.

2. The system for one-way data release based on message feature recognition according to claim 1, characterized in that, The encrypted message feature recognition module parses the protocol identifier, port number, and encryption identifier fields in the message header to preliminarily determine the encryption type; it extracts information such as the fixed feature code and encryption block length of the message payload and matches them with a preset encryption protocol feature library to classify communication messages and data messages.

3. The system for one-way data release based on message feature recognition according to claim 1, characterized in that, The unencrypted message traffic desensitization module maintains sensitive information fields and desensitization rules based on a configuration file, and supports two desensitization modes: fuzzy matching and precise matching. If an unencrypted message flows in, the unencrypted message traffic desensitization module disassembles the message data segment, matches sensitive fields using regular expressions, and performs replacement, masking, or truncation processing on the matched fields to reconstruct the message format.

4. The system for one-way data release based on message feature recognition according to claim 1, characterized in that, The aforementioned traffic packet routing and transmission module has built-in dual transmission channels, corresponding to the flow directions of "low storage security requirements to high storage security requirements" and "high storage security requirements to low storage security requirements" respectively; the packets are allocated to the corresponding channels based on the classification results and domain identification information output by the packet feature recognition module.

5. The system for one-way data release based on message feature recognition according to claim 1, characterized in that, The packet blocking module monitors the flow channel from "high storage security requirements to low storage security requirements" in real time. If a data packet is detected, the blocking mechanism is triggered, the current packet is discarded, and a link termination signal is sent. If a handshake message is detected, the request is allowed to proceed normally.

6. A method for achieving one-way data release based on message feature recognition in the system of claim 1, characterized in that, The method includes the following steps: (1) Access the bidirectional protocol data stream, filter invalid packets and execute standardized formats; (2) Identify the encryption status of the message, perform feature identification on the encrypted message to distinguish between communication messages and data messages, and mark the storage security requirements of the unencrypted message; (3) De-identify sensitive information fields in unencrypted messages according to preset de-identification rules; (4) Assign the message to the corresponding transmission channel of "low storage security requirement to high storage security requirement" or "high storage security requirement to low storage security requirement", and mark the flow information; (5) Allow all packets flowing from "low storage security requirements to high storage security requirements", block data packets flowing from "high storage security requirements to low storage security requirements", and allow communication packets flowing in that direction.

7. The method for achieving one-way data release based on message feature recognition according to claim 1, characterized in that, The specific steps (2) are as follows: The protocol identifier, port number, and encryption identifier fields in the message header are parsed to preliminarily determine the encryption type; information such as the fixed feature code and encryption block length of the message payload is extracted and matched with a preset encryption protocol feature library to classify communication messages and data messages.

8. The method for achieving one-way data release based on message feature recognition according to claim 1, characterized in that, The specific steps (3) are as follows: If an unencrypted message is detected, the unencrypted message traffic desensitization module will disassemble the message data segment, match sensitive fields using regular expressions, and perform replacement, masking, or truncation on the matched fields to reconstruct the message format.

9. The method for achieving one-way data release based on message feature recognition according to claim 1, characterized in that, In step (5), the blocking response time for the data packets flowing from "high storage security requirements to low storage security requirements" does not exceed 1ms, and the communication handshake packets of this flow are retained and allowed to pass.

10. The method for achieving one-way data release based on message feature recognition according to claim 1, characterized in that, The method further includes the following steps: Record and audit the logs, including the identification results, flow, processing actions, and timestamps of each message.

11. A device for realizing one-way data release based on message feature recognition, characterized in that, The device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the steps of the method for one-way data release based on message feature recognition as described in any one of claims 6 to 10.

12. A processor for achieving one-way data release based on message feature recognition, characterized in that, The processor is configured to execute computer-executable instructions, which, when executed by the processor, implement the steps of the method for one-way data release based on message feature recognition as described in any one of claims 6 to 10.

13. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method for one-way data release based on message feature recognition as described in any one of claims 6 to 10.

Images