A method based on data security one-way transmission and physical isolation

Abstract

This invention relates to a method for secure unidirectional data transmission and physical isolation, comprising an external data receiving module, a first microprocessor, a specific wavelength invisible light emitting module, an optical filtering module, a specific wavelength invisible light receiving module, a second microprocessor, and a final data user terminal. In this invention, due to the unidirectional nature of optical data, the specific wavelength invisible light emitting module can only emit light; the specific wavelength invisible light receiving module can only sense light; and the final data can only be transmitted from the specific wavelength invisible light emitting module to the specific wavelength invisible light receiving module, and cannot be transmitted in the opposite direction. This ensures that data can only enter the internal PC / server from the external environment, and cannot be transmitted from the internal PC / server to the external environment. This achieves unidirectional data transmission from the external environment to the internal environment while avoiding any cable or wireless electromagnetic communication connections between the external and internal environments, thus achieving physical isolation.

Description

Technical Field

[0001] This invention belongs to the field of data transmission technology, specifically relating to a method based on secure one-way data transmission and physical isolation. Background Technology

[0002] Computer data security is a very important issue for all organizations and enterprises, and it plays a vital role in their development. Data breaches can cause incalculable and catastrophic losses. Therefore, data security construction has always been an unavoidable and crucial task that all organizations must continuously improve.

[0003] In current data security measures, organizations typically adopt the following common solutions. An intranet is set up to physically isolate the intranet from the external network, preventing direct data exchange between the two networks. When external data needs to be stored, it is usually copied through a removable storage medium.

[0004] For special devices that require data protection, such as PCs, network access and connection to various external devices should be prohibited. The computer's network ports, USB ports, and other communication interfaces should be physically blocked.

[0005] Data that needs protection should be encrypted. When a device is connected to an external network or external device, even if the data is leaked, it must still be desensitized and encrypted.

[0006] However, all of these methods have certain drawbacks. For example, the intranet cannot receive external data in real time, the low ability to acquire external data causes inconvenience to work, and encrypted data is at risk of being cracked. Summary of the Invention

[0007] To overcome the aforementioned problems in the existing technology, this invention provides a method based on secure one-way data transmission and physical isolation, which enables external data to be transmitted in real time to the internal environment or device that needs to receive the data, while physically blocking the channel for data transmission from the inside to the outside, thus absolutely guaranteeing the data security of the internal environment or device.

[0008] A method based on secure unidirectional data transmission and physical isolation, the method comprising the following steps: S1. Receive external data and transmit it to the first microprocessor; S2. The first microprocessor modulates the external data; S3. The specific wavelength invisible light transmitting module transmits and filters the modulated data, which then reaches the specific wavelength invisible light receiving module; S4. The specific wavelength invisible light receiving module performs photoelectric conversion on the received data and then sends the received data to the second microprocessor; S5. The second microprocessor processes the received data and then sends it to the final data user.

[0009] In addition to the aspects and any possible implementations described above, a further implementation is provided in which an external data acquisition module is used to receive the external data, which is a wireless data acquisition module or a wired network data acquisition module.

[0010] In addition to the aspects and any possible implementations described above, an implementation is further provided in which the first microprocessor and the second microprocessor have the same specifications, both being a microcontroller, an ARM processor, or an X86 processor.

[0011] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the transmission further includes controlling the transmission power using a transmission power control module.

[0012] In addition to the aspects described above and any possible implementation, a further implementation is provided in which the specific wavelength invisible light emitting module is provided with a specific wavelength light emitting tube with a wavelength of 940nm, 850nm, 1310nm or 1550nm.

[0013] In addition to the aspects described above and any possible implementation, a further implementation is provided in which the specific wavelength invisible light receiving module is provided with a photosensitive sensor whose center sensing wavelength is the same as the emitted light wavelength of the specific wavelength invisible light emitting module.

[0014] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the final data user is a PC, a server, or an embedded device.

[0015] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the transmit power control module is implemented using an analog signal to PWM signal converter.

[0016] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the second processor and the final data user are connected via a USB bus or an RJ45 Ethernet connection.

[0017] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the filtering is implemented using an optical filtering module for filtering emitted light of a specific wavelength in a specified direction.

[0018] In addition to the aspects described above and any possible implementations, a further implementation is provided in which the second processor and the final data user are connected via a USB bus or an RJ45 Ethernet connection.

[0019] Beneficial effects of the present invention The method based on secure unidirectional data transmission and physical isolation provided by this invention comprises the following steps: S1. Receiving external data and transmitting it to a first microprocessor; S2. The first microprocessor modulates the external data; S3. A specific wavelength invisible light emitting module transmits and filters the modulated data, which then reaches a specific wavelength invisible light receiving module; S4. The specific wavelength invisible light receiving module performs photoelectric conversion on the received data and sends the received data to a second microprocessor; S5. The second microprocessor processes the received data and sends it to the final data user. In this method, due to the unidirectional nature of optical data, the specific wavelength invisible light emitting module can only emit light, i.e., only transmit data; the specific wavelength invisible light receiving module can only sense light, i.e., only receive data; ultimately, the data can only be transmitted from the specific wavelength invisible light emitting module to the specific wavelength invisible light receiving module, and cannot be transmitted in reverse. This ensures that data can only enter the internal PC / server from the external environment, and cannot be transmitted from the internal PC / server to the external environment. This achieves one-way data transmission from the external environment to the internal environment, while also preventing any cable or wireless electromagnetic communication connections between the external and internal environments, thus achieving physical isolation. Attached Figure Description

[0020] Figure 1 This is a flowchart of the method of the present invention; Figure 2 This is a schematic diagram of one embodiment circuit of the present invention; Figure 3 This is a schematic diagram of a second embodiment circuit of the present invention; Figure 4 This is a schematic diagram showing the relationship between the PMW duty cycle and the output current function of the present invention; Figure 5 This is a state transition diagram of each device in the present invention; Figure 6 This is a schematic diagram of the device structure of the present invention. Detailed Implementation

[0021] To better understand the technical solution of this invention, the content of this invention includes, but is not limited to, the specific embodiments described below. Similar technologies and methods should be considered within the scope of protection of this invention. To make the technical problems to be solved, the technical solutions, and advantages of this invention clearer, a detailed description will be provided below in conjunction with the accompanying drawings and specific embodiments.

[0022] It should be understood that the embodiments described in this invention are merely some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0023] The terminology used in the embodiments of this invention is for the purpose of describing particular embodiments only and is not intended to limit the invention. The singular forms “a,” “the,” and “the” as used in the embodiments of this invention and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0024] like Figure 1 As shown, the present invention provides a method based on secure one-way data transmission and physical isolation, which specifically includes the following steps: S1. The external data receiving module transmits external data to the first microprocessor; S2. The first microprocessor modulates the external data; S3. The specific wavelength invisible light emitting module transmits the modulated data, which passes through the optical filtering module and reaches the specific wavelength invisible light receiving module; S4. The specific wavelength invisible light receiving module performs photoelectric conversion on the received data and then sends the received data to the second microprocessor. S5. The second microprocessor processes the received data and then sends it to the final data user.

[0025] Furthermore, external data reception is achieved using an external data receiving module 1. This module can be a wireless data acquisition module such as Bluetooth, WIFI, LoRa, or ZigBee, or a wired network data acquisition module. It is used to receive data from the external environment, such as the external network or other individual devices. In this invention, the external data receiving module uses a LoRa wireless protocol receiving module, operating in the 433MHz wireless frequency band. The module model is A39C-T400A20S2a. The A39C-T400A22S1a is a 410~525MHz, 158mW, highly stable, industrial-grade wireless serial port module. It uses LoRa spread spectrum modulation, and the measured transmission distance can reach up to 5000 meters. This module has data broadcasting, data monitoring, fixed-point transmission, master-slave mode, automatic relay, fixed-point wake-up, and other transmission modes. It supports ultra-low power consumption, diverse functions, and extremely high stability, and can be widely used in various environments to realize wireless data transmission.

[0026] In this invention, after receiving external data wirelessly, the A39C-T400A20S2a forwards the data through the serial port interface formed by pins 3 and 4 on its chip, and supplies it to the first microprocessor 2 at the next stage.

[0027] The first microprocessor 2, which can be a microcontroller, ARM processor, x86 processor, etc., is used to encrypt the data received by the external data receiving module 1 and then modulate it to a specific wavelength invisible light emitting module for transmission. Encrypting the data in the microprocessor 1 prevents it from being intercepted and stolen during transmission by the specific wavelength invisible light emitting module. The encryption and modulation operations are implemented using proprietary or open-source algorithms based on user data security considerations. This invention uses existing technology, therefore, it will not be elaborated further. Taking the STM32F103C8T6 microprocessor as an example, the STM32F103C8T6 is a mid-capacity, high-performance 32-bit microcontroller from STMicroelectronics, based on the ARM Cortex-M3 core. With its high performance, rich peripheral configuration, mature development ecosystem, and high cost-effectiveness, the STM32F103C8T6 is widely used in industrial, consumer, and IoT fields, especially suitable for cost-sensitive small-to-medium-scale embedded projects that require both real-time control and communication functions.

[0028] In this invention, such as Figure 2 As shown, the STM32F103C8T6 microprocessor receives data forwarded by the A39C-T400A20S2a through the serial interface formed by its pins 21 and 22. After encrypting the data internally, it modulates the data onto the PA14 pin and outputs it in serial format to drive the subsequent invisible wavelength invisible light emitting module 3 to transmit data. The encryption and modulation process is implemented using an existing proprietary algorithm, and the specific implementation process will not be described in detail in this invention.

[0029] The specific wavelength invisible light emission module 3 used for emission is equipped with a specific wavelength light emission tube. In actual use, invisible light such as infrared and ultraviolet can be selected, and the wavelength can be selected such as 940nm, 850nm, 1310, 1550nm, etc.; laser can also be selected. Its emission is modulated by the first microprocessor 1 and is used to perform electro-optic conversion and emission of the data modulated by the first microprocessor 1.

[0030] For the specific wavelength invisible light emitting module 3, this invention specifically employs an invisible light or laser emitting module to avoid the influence of ambient light such as sunlight and lamplight on the transmission and reception process, thus ensuring transmission reliability. If visible light were used, the transmission performance would be greatly affected by ambient light, or even impossible, severely limiting its application scenarios.

[0031] like Figure 2As shown, taking the 940nm infrared light emission module 3 as an example, the emission module includes a driver chip MT9201, a TSAL6200 infrared LED, an NMOS transistor Q1, and a NAND gate logic chip 7402. Pins 2 and 3 of the NAND gate 7402 are logic input pins, and pin 1 is the output pin. The logic level of pin 1 is equal to the result of the NAND calculation of the logic levels of pins 2 and 3, which can be expressed as a function as: Where Y is the logic level of pin 1, and A and B are the logic levels of pins 2 and 3, respectively.

[0032] Pin 3 of the 7402 is connected to 3.3V via a 10K resistor, which is the fixed input logic 1. Pin 2 is connected to pin PA14 of the first microprocessor 1. The gate (G) of NMOS transistor Q1 is connected to pin 1 of the NAND gate 7402. Therefore, the voltage level of the gate (G) of NMOS transistor Q1 is... That is, the logic level of the gate (G) of NMOS transistor Q1 is exactly the opposite of the logic level of pin PA14. When the logic level of pin PA14 is 1, the logic level of the gate (G) of NMOS transistor Q1 is 0, i.e., the input voltage is 0V; when the logic level of pin PA14 is 0, the logic level of the gate (G) of NMOS transistor Q1 is 1, i.e., the input voltage is 3.3V.

[0033] In the current path of the infrared LED TSAL6200, TSAL6200 and the drain of NMOS transistor Q1 are connected in series through a 1-ohm resistor R4. For the N-type MOS Q1, when its gate input is logic 1 (high level), NMOS transistor Q1 is turned on, and TSAL6200 is powered on and illuminates; when the gate input of Q1 is logic 0 (low level), NMOS transistor Q1 is turned off, and TSAL6200 is powered off and turns off. That is, when the PA14 pin of the first microprocessor 1 is logic 0, TSAL6200 is powered on and illuminates; when the PA14 pin of the first microprocessor 1 is logic 1, TSAL6200 is powered off and turns off.

[0034] The MT9201 is an LED driver chip that, together with inductor L1 (LP4030) and diode D2, forms a boost driver circuit to provide driving voltage and current to the subsequent TSAL6200 infrared LED. The output power of the MT9201 driver chip can be controlled by inputting a PWM waveform with different duty cycles through pin 4 (CRT) to achieve different drive power outputs, thereby adjusting the brightness of the LED and thus achieving different emission distances. This PWM waveform comes from the emission power control module 4, meaning that pin 4 of the driver chip is connected to the PWM pin of the emission power control module 4. Figure 4As shown, the PMW duty cycle (PWMDimming) input at the CRT pin has a functional relationship with the output current (LED Current). It can be seen that the higher the PMW duty cycle (PWM Duty Cycle), the greater the output current.

[0035] During transmission, power control is performed using the transmission power control module 4, which can adjust the transmission power of the invisible light transmission module at a specific wavelength according to the actual situation to meet different transmission distances and facilitate the deployment of transceiver equipment in actual environments.

[0036] This power control module includes an analog-to-PWM converter GP9101 and an adjustable sliding resistor R2. The GP9101 acts as an ADC with PWM signal output. This chip can linearly convert analog voltages from 0V to the power supply voltage VCC into PWM signals with a duty cycle of 0% to 100%. When a voltage in the range of 0V-VCC is input to its pin 3 (VIN), its pin 6 (PWM) will output a PWM signal with a duty cycle of 0% to 100%. In actual use, the two ends of the adjustable sliding resistor R2 are connected to VCC and ground respectively, and its adjustable end is connected to pin 3 (VIN) of the GP9101. By adjusting the resistance value of the sliding resistor, the input voltage at pin VIN can be varied from 0V to VCC, thereby achieving PWM waveform outputs with different duty cycles. This PWM waveform is then input to a specific wavelength invisible light emitting module to control the output power of its LED driver circuit.

[0037] The filtering is achieved using an optical filtering module 5, which filters emitted light of a specific wavelength from a designated direction, ensuring it reaches the subsequent invisible light receiving module of that specific wavelength. Light from other directions is filtered out by the optical filtering module and cannot reach the invisible light receiving module, thus achieving the purpose of optical interference filtering. In this invention, the optical filtering module is implemented using an optical polarizer. The optical polarizer is a special optical device that allows light parallel to the direction of the internal grating to pass through, while blocking light from other directions. The optical polarizer has regularly arranged micro-gratings inside, forming grating slits. These grating slits only allow light waves from one direction to pass through, filtering out light from other directions. That is, light parallel to the grating slits can pass through completely, while light perpendicular to the grating slits is completely blocked. For oblique light at other angles to the grating slits, the larger the angle with the grating slits, the stronger the filtering, meaning it is difficult for light to pass through.

[0038] In this invention, the optical polarizing mirror allows the specific wavelength incident light, i.e., infrared light, from the specific wavelength invisible light emitting module 3 and directly facing the specific wavelength invisible light receiving module 7 to pass through, while filtering out possible interference light from the environment that has the same wavelength as the specific wavelength incident light between the specific wavelength light emitting module 3 and the optical filtering module 5, thereby eliminating other stray interference light.

[0039] To avoid interference with the received light, a light-shielding pipe 6 is set between the light filtering module and the specific wavelength invisible light receiving module 7. The light-shielding pipe is an opaque pipe. The photosensitive sensor configured in the specific wavelength invisible light receiving module 7 is placed in the light-shielding pipe. The light-shielding pipe 6 is used to block the light on the same side of the photosensitive sensor to avoid interference from incoherent light.

[0040] The specific wavelength invisible light receiving module 7 is equipped with the aforementioned photosensitive sensor, whose center sensing wavelength is consistent with the emitted light wavelength of the specific wavelength invisible light emitting module 3, and is used to receive data from the specific wavelength invisible light emitting module. The specific wavelength invisible light receiving module 7 performs relevant photoelectric conversion on the received data and then sends the data to the second microprocessor 8. The phototransistor used is model MHL524PT03BRT, with a center sensing wavelength of 940nm, consistent with the wavelength of the emitting module. Due to the characteristics of the MHL524PT03BRT, it will conduct when illuminated by 940nm light and will be off when there is no 940nm light. The MHL524PT03BRT phototransistor and the SAL6200 infrared LED of the specific wavelength invisible light emitting module 3 are placed facing each other, with a distance ranging from 5cm to 50m. This is because of power control limitations; therefore, in actual use, modulation and emission can be performed within this distance range. The MHL524PT03BRT phototransistor Q4 will conduct or cut off depending on the on / off state of the SAL6200 infrared LED. Figure 3As shown, the collector (C) of phototransistor Q4, pin 2, is connected to the power supply VCC through a 2kΩ pull-up resistor R29, while the emitter (E) is grounded. When the phototransistor is on, the voltage at pin 2 is approximately 0, i.e., low level; when phototransistor Q4 is off, the potential at pin 2 is approximately VCC_3V3, i.e., high level. According to the previous description, when PA14 of the first microprocessor 1 is logic 0, the TSAL6200 will be powered on and illuminate; when PA14 of the first microprocessor 1 is logic 1, the TSAL6200 will be off. That is, when PA14 of the first microprocessor 1 is logic 0, the collector (C) of phototransistor Q4 (pin 2) will be 0; when PA14 of the first microprocessor 1 is logic 1, the collector (C) of phototransistor Q4 (pin 2) will be 1. This achieves complete pin level synchronization, meaning that the function is equivalent to a wire connection through optical transmission. The state transmission is as follows... Figure 5 As shown.

[0041] The second microprocessor 8, which can be a microcontroller, ARM processor, x86 processor, etc., is used to demodulate and decrypt data from the invisible light receiving module at a specific wavelength, and then transmit it to the final data user end such as a PC / server / embedded device. Its connection to the final data user end can be via USB, RJ45 Ethernet, or other interfaces. Demodulation and decryption are the reverse processes of encryption and modulation in the first microprocessor 1. Its algorithm is bound to the corresponding encryption and modulation algorithms, and the decryption algorithm is implemented using existing technology, which will not be elaborated further in this invention. The second microprocessor 8 uses the same STM32F103C8T6 microprocessor as the first microprocessor 1 to ensure good software and data compatibility. The RX pin of serial port 3 of the second microprocessor 8 is connected to pin 2 of the output of phototransistor Q4. As described earlier, the state of pin 2 of phototransistor Q4 is completely synchronized with the state of PA14 of the first microprocessor 1. Therefore, the RX pin of serial port 3 of the second microprocessor 8 is completely synchronized with the state of PA14 of the first microprocessor 1, enabling data input from the first microprocessor 1 to the second microprocessor 8. The second microprocessor 8 decrypts the received input data and then modulates the data onto its USB pin, connecting it to the final data user such as a PC / server / embedded device via a Type-C connector.

[0042] As an embodiment disclosed in this invention, such as Figure 6 As shown, the present invention also provides a device based on secure one-way data transmission and physical isolation. The device includes an external data receiving module, a first microprocessor, a specific wavelength invisible light emitting module, an optical filtering module, a specific wavelength invisible light receiving module, a second microprocessor, and a final data user terminal. The external data receiving module is used to receive external data transmission. The first microprocessor is connected to an external data receiving module and is used to process external data; A specific wavelength invisible light emitting module is connected to the first microprocessor to receive and transmit processed data; The optical filtering module filters and removes noise from the transmitted data; A specific wavelength invisible light receiving module performs photoelectric conversion on the filtered and denoised data. The second microprocessor is used to process the photoelectric converted data and send it to the final data user.

[0043] The foregoing description illustrates and describes several preferred embodiments of the present invention. However, as previously stated, it should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the inventive concept described herein through the foregoing teachings or techniques or knowledge in related fields. Any modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A method based on secure unidirectional data transmission and physical isolation, characterized in that, The method includes the following steps: S1. Receive external data and transmit it to the first microprocessor; S2. The first microprocessor modulates the external data; S3. The specific wavelength invisible light transmitting module transmits and filters the modulated data, which then reaches the specific wavelength invisible light receiving module; S4. The specific wavelength invisible light receiving module performs photoelectric conversion on the received data and then sends the received data to the second microprocessor. S5. The second microprocessor processes the received data and then sends it to the final data user.

2. The method according to claim 1, characterized in that, The external data is received using an external data acquisition module, which can be a wireless data acquisition module or a wired network data acquisition module.

3. The method according to claim 1, characterized in that, The first and second microprocessors have the same specifications; both are single-chip microcomputers, ARM processors, or x86 processors.

4. The method according to claim 1, characterized in that, The launch also includes using a launch power control module to control the launch power.

5. The method according to claim 1, characterized in that, The specific wavelength invisible light emitting module is equipped with a specific wavelength light emitting tube with a wavelength of 940nm, 850nm, 1310nm or 1550nm.

6. The method according to claim 1, characterized in that, The specific wavelength invisible light receiving module is equipped with a photosensitive sensor, the central sensing wavelength of which is the same as the emitted light wavelength of the specific wavelength invisible light emitting module.

7. The method according to claim 1, characterized in that, The final data user is a PC, server, or embedded device.

8. The method according to claim 4, characterized in that, The transmit power control module is implemented using an analog signal to PWM signal converter.

9. The method according to claim 1, characterized in that, The second processor is connected to the final data user via a USB bus or an RJ45 Ethernet connection.

10. The method according to claim 1, characterized in that, The filtering is achieved using an optical filtering module, which is used to filter emitted light of a specific wavelength in a specified direction.

Images