A large instrument data security external sending system and method based on dual-computer isolation

Abstract

The application belongs to the technical field of data security and scientific research instrument management, and particularly relates to a large instrument data security sending system and method based on double-computer isolation, which comprises two computers connected through a safe one-way link but physically isolated, and is respectively a host computer and a slave computer; the host computer is a control computer of the large instrument, and a special data output folder is set on the host computer; the slave computer is provided with an automatic data sending program, which performs: (1) file monitoring; (2) file acquisition and processing; (3) safe sending; (4) sending record and duplication checking; and (5) local backup. The application realizes safe, automatic and one-way sending of large instrument data through the combination of physical isolation and logical control, and the slave computer also completes data backup. The application is particularly suitable for nuclear magnetic resonance instruments and other large analysis instruments which need to strictly control the safety of the host computer.

Description

Technical Field

[0001] This invention belongs to the field of data security and scientific instrument management technology, specifically relating to a system and method for securely transmitting data from large-scale instruments based on dual-machine isolation. By combining physical isolation with logical control, it achieves secure, automatic, and unidirectional data transmission from large-scale instruments, while the secondary machine simultaneously performs data backup. This invention is particularly suitable for large analytical instruments such as nuclear magnetic resonance spectrometers that require strict control over the security of the main unit. Background Technology

[0002] For large instruments such as nuclear magnetic resonance spectrometers, their control host (hereinafter referred to as "host") usually runs a proprietary and vulnerable control system. Once infected with a virus or subjected to uncontrolled system updates, it can easily lead to instrument failure and cause significant losses. To ensure the security of the host, the current common practice is to physically isolate it from the Internet.

[0003] However, this physical isolation makes it difficult to transfer data. Researchers typically need to manually copy data between the host computer and a network-connected computer using removable storage media such as USB flash drives. This method has the following problems:

[0004] 1. Risk of virus transmission: USB flash drives can become a carrier for viruses to spread across physical barriers, seriously threatening host security.

[0005] 2. Cumbersome and inefficient operation: It requires manual intervention for copying and transmission, which is cumbersome and wastes the time of researchers.

[0006] 3. Disorganized data management: The lack of automated recording and deduplication mechanisms can easily lead to duplicate or missing data.

[0007] 4. Unable to send data out in real time or automatically: Data cannot be sent to users automatically and in a timely manner after it is generated.

[0008] 5. Missing data backup: The current process fails to automatically complete data backup, posing a risk of data loss and failing to guarantee data integrity and recoverability. Summary of the Invention

[0009] The purpose of this invention is to provide a method that automatically, securely, and reliably transmits newly generated data from the host computer to the user, while ensuring absolute network security (i.e., no connection to the Internet) for the host control unit of a large instrument, and simultaneously performs data backup on the secondary computer. This completely eliminates manual operation using removable storage media and avoids any security threats or performance interference to the host system.

[0010] To achieve the above objectives, the present invention provides a system and method for securely transmitting data from large instruments based on dual-machine isolation.

[0011] The specific technical solution is as follows:

[0012] A large-scale instrument data secure transmission system based on dual-machine isolation includes two physically isolated computers connected by a secure unidirectional link (such as a private network cable), namely a host and a slave computer.

[0013] Main unit: This is the control computer for large instruments (such as MRI scanners), running the instrument control software. This main unit is physically disconnected from the internet, connected to the secondary unit only via an internal network cable. A dedicated data output folder is configured on the main unit.

[0014] Secondary machine: A standalone computer with internet access. It hosts an automated data outbound program. This program periodically or in real-time performs the following core tasks:

[0015] (1) File monitoring: Monitor whether new files are generated in the dedicated data output folder on the host through the internal network link.

[0016] (2) File acquisition and processing: When a new file is detected, the file is automatically copied from the host to the local machine of the slave machine and compressed (such as in ZIP format) for easy transmission and storage.

[0017] (3) Secure outbound transmission: The processed file is automatically sent to a preset public data mailbox through the Internet connection of the secondary machine.

[0018] (4) Sending record and deduplication: A record of sent files is maintained locally on the secondary machine. Before each sending task is executed, the program compares the file to be sent with the record to ensure that the same file is not sent repeatedly.

[0019] (5) Local backup: After the secondary machine obtains the file, it automatically saves the original copy of the file in the local storage path to complete the data backup and ensure data security and recoverability.

[0020] A method for securely transmitting data from large-scale instruments based on dual-machine isolation includes the following steps:

[0021] The host computer runs the instrument control software;

[0022] The secondary unit performs the following steps:

[0023] (1) File monitoring: Monitor whether new files are generated in the dedicated data output folder on the host through the internal network link.

[0024] (2) File acquisition and processing: When a new file is detected, the file is automatically copied from the host to the local machine of the slave machine and compressed to facilitate transmission and storage.

[0025] (3) Secure outbound transmission: The processed file is automatically sent to a preset public data mailbox through the Internet connection of the secondary machine.

[0026] (4) Sending record and deduplication: A record of sent files is maintained locally on the secondary machine. Before each sending task is executed, the program compares the file to be sent with the record to ensure that the same file is not sent repeatedly.

[0027] (5) Local backup: After the secondary machine obtains the file, it automatically saves the original copy of the file in the local storage path to complete the data backup and ensure data security and recoverability.

[0028] The key to this invention lies in the fact that all operations involving internet access, email sending, file compression, and other activities that may introduce security risks or consume system resources are performed on the secondary machine. The primary machine only plays a passive role, sharing data through a secure intranet, thus ensuring the highest level of system purity, stability, and security.

[0029] Compared with the prior art, the present invention has the following significant effects:

[0030] 1. Extremely high host security: The host is completely isolated from the internet, fundamentally eliminating system risks caused by network attacks, virus downloads, or forced updates. The only data channel with the outside world is a one-way acquisition link strictly controlled by the secondary machine program, making the risk manageable.

[0031] 2. Automated and efficient data outsourcing: The entire process from data generation to delivery to the user's email is automated, eliminating the need for manual copying using USB drives, greatly improving data flow efficiency and saving labor costs.

[0032] 3. Eliminates the risk of viruses on removable media: Completely eliminates the need for USB flash drives, cutting off this primary route for viruses to enter physically isolated networks.

[0033] 4. Stable and reliable operation: Outbound tasks run on an independent secondary machine. Even if the program malfunctions or requires maintenance, it will not affect the normal operation of the instrument control system on the main unit. The deduplication mechanism avoids the chaos of repeated data transmission.

[0034] 5. Low implementation cost and good compatibility: It only requires adding a regular computer and deploying automation scripts, without modifying the expensive instrument host hardware and software, making it easy to deploy and promote on existing instruments. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of the structure of the present invention. Detailed Implementation

[0036] The specific technical solution of the present invention will be described in conjunction with the accompanying drawings.

[0037] like Figure 1 As shown, this embodiment includes an MRI host and an MRI slave computer. The two computers are connected by a network cable. The host computer is not connected to the Internet, while the slave computer can connect to the Internet. In order to ensure the security of the host computer, it will not update automatically and there is no risk of virus. The slave computer can connect to the Internet and can send emails. The purpose of the code written on the slave computer includes: (1) detecting new files; (2) compressing them into zip files; (3) sending files to a public mailbox that everyone can access; (4) recording the files that have been sent and preventing them from being sent repeatedly. All the work is done on the slave computer and will not affect the host computer.

[0038] This embodiment can be simply compared to an assembly line with two workers, consisting of two small rooms working side by side:

[0039] Main Room (NMR Main Unit): This is a completely enclosed room. Inside is a highly professional craftsman (NMR instrument) who never comes into contact with the outside world. His job is to produce exquisite products (NMR experimental data). He is only responsible for making the products and placing them in a small portal (shared folder) leading to the next room.

[0040] Sub-room (NMR Sub-computer): This is a room that can communicate with the outside world. It contains an assistant (sub-computer computer). The assistant's task is to periodically check the delivery port, and once a new product is found, immediately pack it, label it, and send it to the person who needs it via courier (email).

[0041] The key security design: the two rooms are connected only by a small, inward-opening window (network cable connection). The craftsman (master) cannot access anything in the assistant's (secondary) room through this window, nor can he access the outside world (the internet). This way, even if the assistant accidentally brings back dust (viruses), they will absolutely not reach the craftsman, ensuring the absolute security of the craftsman's room.

[0042] The problems solved by this embodiment include:

[0043] Absolutely safe: The MRI host is completely "disconnected from the internet," eliminating the risk of viruses, malware, and misoperation, ensuring the stable operation of the multi-million dollar instrument.

[0044] Fully automated: Once the experiment is completed, the data will automatically appear in a public email address, requiring no manual operation.

[0045] Convenient and fast: Users can download data by logging into the public email account with their mobile phone or computer from anywhere with internet access, eliminating the need for USB drives.

[0046] Well-organized: The system automatically records which data has been sent, ensuring that it is never sent repeatedly or missed.

[0047] The system setup process in this embodiment is as follows:

[0048] Prepare:

[0049] 1. A working MRI scanner and its control computer (host).

[0050] 2. An additional regular desktop or laptop computer (secondary computer).

[0051] 3. A regular network cable.

[0052] 4. A 163 email account that can be logged into normally (for sending emails).

[0053] 5. Install Python on the secondary machine.

[0054] Part 1: Physical Connections and Network Configuration

[0055] Step 1: Disconnect the host's external connection channel;

[0056] On the MRI host, right-click the network icon in the lower right corner of the computer and open "Network and Internet settings".

[0057] Go to "Change adapter options".

[0058] You will see several network connection icons (possibly named "WLAN," "Ethernet 2," etc.). Except for the "Ethernet" icon corresponding to the port you intend to use to connect the secondary computer, right-click on all other network connections and select "Disable." This is equivalent to locking all other doors on the primary computer, leaving only one door open to the secondary computer.

[0059] Step 2: Connect the two computers with a network cable;

[0060] Insert one end of the prepared network cable into the only valid network port on the back of the host computer, and the other end into any network port on the secondary computer.

[0061] Step 3: Configure the main and secondary machines to "speak the same language";

[0062] Configure a private "conversation channel" on both computers.

[0063] On the host:

[0064] 1. Open "Control Panel" -> "Network and Sharing Center" -> "Change adapter settings".

[0065] 2. Right-click the only "Ethernet" connection and select "Properties".

[0066] 3. Double-click "Internet Protocol Version 4 (TCP / IPv4)".

[0067] 4. Select "Use the following IP address":

[0068] 3. IP address: Enter 192.168.1.100

[0069] 4. Subnet mask: Enter 255.255.255.0

[0070] Default gateway: Leave blank

[0071] 5. Click OK.

[0072] On the secondary aircraft:

[0073] 1. Similarly, open the properties of the "Ethernet" connection and enter the IPv4 settings.

[0074] 2. Select "Use the following IP address":

[0075] IP address: Enter 192.168.1.101

[0076] Subnet mask: Enter 255.255.255.0

[0077] Default gateway: Leave blank

[0078] 3. Click OK.

[0079] Verify the connection: On the secondary computer, press Win + R, type cmd and press Enter to open the command prompt. Type the command: ping 192.168.1.100 and press Enter. If you see "Reply from 192.168.1.100", congratulations, the two computers have successfully connected!

[0080] Step 4: Create a "port" (shared folder) on the host computer;

[0081] 1. On the host computer, find a disk with enough space (such as drive D), create a new folder and name it: NMR_Data_Export.

[0082] 2. Right-click on this folder and select "Properties".

[0083] 3. Switch to the "Sharing" tab and click "Advanced Sharing...".

[0084] 4. Check "Share this folder" and then click "Permissions".

[0085] 5. In the pop-up window, ensure "Everyone" is selected, and then in the permissions below, only check "Read". This ensures that the secondary machine can only copy files, not modify or delete them. Click OK.

[0086] 6. Note down the host's IP address (192.168.1.100) and share name (NMR_Data_Export).

[0087] Part Two: Deploying the "Automation Assistant" (Python script) on the secondary machine

[0088] Step 5: Prepare the auxiliary machine's "workbench";

[0089] 1. Ensure the secondary unit can connect to the internet (via Wi-Fi or another network cable).

[0090] 2. Install the necessary software:

[0091] Install Python (download and install it from the official python.org website, and remember to check "Add Python to PATH").

[0092] Install the compression software 7-Zip (download from the official website 7-zip.org) and remember the installation path (usually C:\Program Files\7-Zip\).

[0093] Step 6: Obtain and place the "Workbook" (Python script);

[0094] 1. A pre-written automation script will be used. The provided code (attached) needs to be saved as a file.

[0095] 2. On the secondary machine, select a location (e.g., the root directory of drive D) and create a new folder named NMR_Auto_Sender.

[0096] 3. In this folder, create a new text document and open it with Notepad.

[0097] 4. Copy the entire provided code (from import smtplib to the end) and paste it into this notepad.

[0098] 5. Click "File" -> "Save As". In the save window:

[0099] Filename input: nmr_auto_send.py

[0100] The most crucial step: In the "Save as type" drop-down menu, select "All Files (.)". This will ensure it's saved as a .py file instead of a .txt file.

[0101] Select UTF-8 encoding.

[0102] Click Save.

[0103] Step 7: Modify the key information (configuration file) in the "Work Manual";

[0104] You need to reopen the nmr_auto_send.py file with Notepad and modify a few lines to let the script know exactly how to work.

[0105] Find and modify the following sections (you can use Notepad's "Find" function):

[0106] 1. Email Configuration: Locate mail_sender (sender email address) and mail_license (authorization code, not the email password; you need to obtain the "SMTP service authorization code" in your 163 email settings). Also modify mail_receiver (recipient email address; you can set it to a public email address).

[0107] 2. Path configuration:

[0108] `src = r'Y:\\NMR\\data\\nmrsu\\nmr'`: This is the original path where the data is actually generated on the host machine. You need to modify it according to the actual data storage location of the NMR instrument. If you are unsure, please consult the instrument administrator.

[0109] `des = r'F:\\NMR\\data\\nmrsu\\nmr'`: This is the local path used by the slave machine when copying data from the master machine. It can remain unchanged or be modified to a path on the slave machine.

[0110] command = "D:\\7-Zip\\. / 7z...: In this command line, D:\\7-Zip\\ needs to be replaced with the actual path where 7-Zip is installed on your secondary machine.

[0111] 3. Connection Test: Locate the line `ret = os.system("ping www.baidu.com ...)`. This script tests whether the secondary machine is connected to the internet. If you are concerned about network issues, you can leave it blank for now.

[0112] Step 8: Get the "assistant" working (run the script);

[0113] 1. On the secondary machine, open "File Explorer" and go to the NMR_Auto_Sender folder.

[0114] 2. In an empty space in the folder, hold down the Shift key and right-click, then select "Open PowerShell window here" or "Open command window here".

[0115] 3. In the pop-up black command line window, type the following command and press Enter: python nmr_auto_send.py

[0116] 4. If everything is configured correctly, you will see messages such as "File synchronization in progress..." and "File scanning in progress..." scrolling on the screen, without any error messages.

[0117] 5. Keep the script running: Do not close this command line window. You can minimize it. The script will automatically check the host for new data every 30 seconds.

[0118] Step 9: [Advanced Settings] Enable "Assistant" to start automatically on boot;

[0119] If you want this script to run automatically when the secondary computer is turned on, without requiring manual activation:

[0120] 1. On the secondary computer, press Win + R, type shell:startup and press Enter. This will open the "Startup" folder.

[0121] 2. In the NMR_Auto_Sender folder, right-click the nmr_auto_send.py file and select "Create shortcut".

[0122] 3. Cut and paste the newly created shortcut into the "Startup" folder that you just opened.

[0123] 4. In this way, the script will automatically run in the background every time the secondary machine is turned on.

[0124] The method for ordinary users to obtain data is as follows:

[0125] 1. Complete the experiment: You will complete the sample test on the NMR instrument.

[0126] 2. No operation required: No action needs to be taken on the instrument's computer. Data will be automatically saved to the host's shared folder.

[0127] 3. Waiting for emails: Usually within a few minutes, the secondary machine "assistant" will detect new data and automatically package and send it to the preset public email address (e.g., nmr_public@163.com).

[0128] 4. Download via email: Open your computer or mobile phone and log in to this public email address. You will see a new email in your "Inbox" with the experimental data in a ZIP archive attached. Download it to your local computer.

[0129] The entire process requires absolutely no physical contact with the MRI machine, and no USB drive is needed. All tasks are completed automatically and securely in the background.

[0130] The troubleshooting method in this embodiment is as follows:

[0131] Problem: The secondary machine's script displays the message "Network connection lost" or "Unable to send email".

[0132] Check: Confirm that the secondary computer can access the internet normally (try opening a browser).

[0133] Problem: I am not receiving emails.

[0134] Check 1: Check the "Spam" folder in the public mailbox.

[0135] Check 2: On the secondary machine, check the script running window to see if there is a "successfully sent" or "unable to send" message.

[0136] Problem: The script is displaying an error message indicating that the path or file cannot be found.

[0137] Check: Carefully verify that the original path of src modified in step 7 is correct. This is the most error-prone area.

Claims

1. A large-scale instrument data secure transmission system based on dual-machine isolation, characterized in that, This includes two physically isolated computers connected via a secure unidirectional link, namely the host and the slave computer; Main unit: This is the control computer for large instruments, running the instrument control software; the main unit is physically disconnected from the Internet, and is only connected to the auxiliary unit through an internal network cable; a dedicated data output folder is set up on the main unit; Secondary machine: A standalone computer with internet access, deployed with an automated data outbound program that periodically or in real-time executes the following core tasks: (1) File monitoring: Monitor whether new files are generated in the dedicated data output folder on the host through the internal network link; (2) File Acquisition and Processing: When a new file is detected, it is automatically copied from the host machine to the local machine of the slave machine and compressed. (3) Secure outbound transmission: The processed files are automatically sent to a preset public data mailbox via the secondary machine's own Internet connection; (4) Sending record and deduplication: A record of sent files is maintained locally on the secondary machine. Before each sending task is executed, the program compares the file to be sent with the record to ensure that the same file is not sent repeatedly. (5) Local backup: After the secondary machine obtains the file, it automatically saves the original copy of the file in the local storage path to complete the data backup; 2. A method for securely transmitting data from large-scale instruments based on dual-machine isolation, characterized in that, The large-scale instrument data security transmission system based on dual-machine isolation as described in claim 1 includes the following processes: The host computer runs the instrument control software; The secondary machine performs the following procedures: (1) File monitoring: Monitor whether new files are generated in the dedicated data output folder on the host through the internal network link; (2) File acquisition and processing: When a new file is detected, the file is automatically copied from the host to the local machine of the slave machine and compressed. (3) Secure outbound transmission: The processed files are automatically sent to a preset public data mailbox via the secondary machine's own Internet connection; (4) Sending record and deduplication: A record of sent files is maintained locally on the secondary machine. Before each sending task is executed, the program compares the file to be sent with the record to ensure that the same file is not sent repeatedly. (5) Local backup: After the secondary machine obtains the file, it automatically saves the original copy of the file in the local storage path to complete the data backup.

Images