A message bus-based cross-security domain data synchronization method and system

Abstract

The application discloses a kind of cross-security domain data synchronization method and system based on message bus, comprising: collecting original data from source security domain, carrying out sensitivity classification and channel level matching, and encapsulating into standardized message envelope containing routing information, security label and check value;The data in the envelope is encrypted and digitally signed, and according to the real-time health score and security label of each transmission channel, a target channel is dynamically selected from multiple parallel channels;The encrypted envelope is transmitted to the target security domain across the security isolation boundary through the target channel, and content security detection and traffic management are performed during transmission;In the target security domain, the received envelope is verified, integrity and timeliness are checked, and after idempotent deduplication, the decrypted and restored data is distributed to the target business system and a transmission receipt is generated.

Description

Technical Field

[0001] This invention relates to the field of data exchange technology, and in particular to a method and system for cross-security domain data synchronization based on a message bus. Background Technology

[0002] With the widespread application of information systems in government and enterprise units, the demand for cross-network and cross-regional data exchange is increasing. Different security domains typically have physical or logical isolation mechanisms. To ensure network security and data confidentiality, data transmission must be forwarded and audited through a secure and controllable intermediate system. Existing secure data transmission solutions mostly rely on secure isolation and information exchange systems or one-way import / export devices. By setting up data exchange nodes between security domains, controlled exchange of different types of data, such as files, databases, and messages, is achieved. These systems generally include pre-processing modules, transmission control modules, data inspection modules, and post-processing modules, and implement data security protection through technologies such as access control, virus detection, protocol parsing, and content filtering.

[0003] In typical existing technical solutions, the data exchange process usually includes the following steps: the front-end system receives data requests from the source business system; the data undergoes format parsing, virus detection, and content filtering; the detected data is written to the exchange cache or transit database; the back-end system periodically pulls data from the cache and imports it into the target domain system; the entire process is audited and traced through log recording. The closest existing technology to this invention employs a primary / backup integrated deployment consisting of a front-end machine, isolation device, and back-end machine, with a fixed data flow and a lack of multi-channel dynamic management mechanisms. While the above methods offer a certain degree of security and controllability in basic data exchange, their structure and strategies are relatively fixed, often employing a single channel or point-to-point data flow method. The transmission path and security policies are difficult to dynamically adjust after system deployment; security protection and business transmission processes are often separated, lacking intelligent scheduling and status awareness capabilities; when the transmission link malfunctions or experiences excessive load, the system cannot automatically switch or recover from the fault, easily leading to data transmission interruptions. Furthermore, since some systems only support single data types such as files or databases, they lack a unified message and interface exchange mechanism, making it difficult to meet the diverse needs of various business scenarios.

[0004] In summary, while existing data security exchange systems can achieve controlled data transmission between different security domains, they still suffer from the following shortcomings: The system structure is simplistic and lacks flexibility, often employing fixed data channels and static configuration strategies, making it impossible to flexibly adjust exchange paths or security policies according to business changes, and lacking modular, dynamically schedulable architectural support; data type support is incomplete, with traditional solutions often only handling file or database data transmission, lacking the ability to uniformly exchange and securely control multiple data types such as message buses and application programming interface requests; security protection is disconnected from the transmission process, with security detection, content filtering, and access control functions independent of the data transmission process, failing to achieve dynamic security verification and behavioral linkage during transmission; and anomaly diagnosis and operational assurance capabilities are weak, often relying on manual troubleshooting in case of node failure, link interruption, or transmission anomalies, failing to achieve automatic detection and intelligent switching, impacting system stability and business continuity. Therefore, existing technologies are insufficient to meet the requirements of secure data exchange across multiple services, channels, and policies. Summary of the Invention

[0005] The main objective of this invention is to provide a cross-security domain data synchronization method based on a message bus.

[0006] Another objective of this invention is to propose a cross-security domain data synchronization system based on a message bus.

[0007] To achieve the above objectives, a first aspect of the present invention proposes a cross-security domain data synchronization method based on a message bus, comprising:

[0008] Raw data is collected from the business system in the source security domain. The raw data is then classified for sensitivity and matched with the channel level according to the preset security policy. The processed data is then encapsulated into a standardized message envelope containing routing information, security labels, and integrity verification values. The business data in the standardized message envelope is encrypted and digitally signed, and the target transmission channel is dynamically selected from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag. The encrypted standardized message envelope is transmitted across the security isolation boundary to the target security domain through the target transmission channel, and content security detection and traffic management control are performed during the transmission process; The target security domain verifies the signature, integrity, and timeliness of the received standardized message envelopes. After filtering duplicate data through an idempotent deduplication mechanism, the decrypted and recovered business data is distributed to the target business system and a transmission receipt is generated.

[0009] In one embodiment of the present invention, the raw data collected from the business system of the source security domain is subjected to sensitivity classification and channel level matching according to a preset security policy, and the processed data is encapsulated into a standardized message envelope containing routing information, security tags, and integrity verification values, including: Raw data is collected from the database incremental logs, file directories, message queues or application interface callbacks of the business system through a multi-source data adaptation layer. Construct a message header that includes message identifier, sequence number, source and destination identifiers, pattern identifier, sensitivity level, channel level, time to live, timestamp, hash value, and acknowledgment mode; and construct message metadata that includes routing hints, algorithm identifier, compression identifier, retransmission window, and quality of service constraints. The original data is used as the payload and combined with the message header and message metadata to form a standardized message envelope; Based on the principle that the data sensitivity must not exceed the channel's security carrying capacity, the sensitivity level is matched with the channel level. When no channel that meets the requirements is available, transmission is suspended and an alarm is generated.

[0010] In one embodiment of the present invention, the matching of sensitivity level and channel level based on the principle that data sensitivity must not exceed the channel security carrying capacity includes: Obtain the type, sensitivity level, source system identifier, destination system identifier, and business scenario characteristics of the raw data; The features are matched with a preset security policy, and the sensitivity level of the original data is determined based on the matching results. The sensitivity levels are mapped to corresponding channel levels, where low-sensitivity data is allowed to be transmitted through multiple channel levels, while high-sensitivity data is only allowed to be transmitted through the corresponding high-security channel.

[0011] In one embodiment of the present invention, the step of encrypting and digitally signing the business data in the standardized message envelope, and dynamically selecting a target transmission channel from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag, includes: The payload in the standardized message envelope is encrypted, and a hash value is calculated for the standardized message envelope before digital signature is performed using a private key. Periodically detect the network performance indicators of each logical transmission channel and smooth the sampled values ​​of the detected indicators; The health score of each logical transmission channel is calculated based on the smoothed standardized scores of each indicator and the preset weights. The encrypted and signed message envelope is submitted to the isolation control module, which determines the required channel level based on the security label in the message envelope and selects the target transmission channel with the highest health score that meets the channel level requirements from multiple parallel transmission channels.

[0012] In one embodiment of the present invention, selecting the target transmission channel with the highest health score and meeting the channel level requirements from multiple parallel transmission channels includes: Real-time monitoring of the health score of the current main channel; when the health score of the current main channel is lower than the switching threshold for multiple consecutive detection cycles, the channel switching process is triggered. When the channel switching process is triggered, the new sending window is frozen and the unacknowledged data fragments are resent. The receiving end then performs order rearrangement and idempotency verification based on the message sequence number to achieve lossless self-healing. When the health score of the original main channel is higher than the cut-back threshold for several consecutive detection cycles, it automatically returns to the original main channel operation state, wherein a hysteresis threshold is provided between the cut-back threshold and the switching threshold.

[0013] In one embodiment of the present invention, the step of transmitting the encrypted standardized message envelope across a security isolation boundary to a target security domain through the target transmission channel, and performing content security detection and traffic governance control during the transmission process, includes: The encrypted standardized message envelope is submitted to the isolation control module, which then forwards the data to the target security domain through the isolation interface. When data passes through the target transmission channel, access control, data leakage prevention detection, and traffic shaping control are performed based on the message header, message metadata, and content characteristics in the envelope. When abnormal data or illegal traffic is detected, the transmission is immediately blocked and the security event is logged.

[0014] In one embodiment of the present invention, the step of verifying the signature, integrity, and timeliness of the received standardized message envelope in the target security domain, filtering duplicate data through an idempotent deduplication mechanism, distributing the decrypted and recovered business data to the target business system, and generating a transmission receipt includes: The received standardized message envelope is digitally signed and verified based on the source certificate or key, and the integrity of the message digest or authentication label is checked. The timeliness and clock deviation are checked based on the timestamp and lifespan in the envelope. If the deviation exceeds the preset threshold or the message has expired, it will be rejected directly. After the verification is passed, the payload is decrypted to restore the business data, and a sliding window deduplication mechanism is established with the source system identifier, message identifier and sequence number as unique keys to perform idempotency judgment and order control on processed or duplicate data. When signature verification fails, integrity verification fails, decryption fails, or duplicate messages are detected, the data will be rejected and an alarm record will be generated.

[0015] In one embodiment of the present invention, the step of distributing the decrypted and recovered business data to the target business system and generating a transmission receipt includes: Based on the pattern identifier or destination routing information in the standardized message envelope, the decrypted and recovered business data is distributed to the database write interface, file disk interface, message bus interface or target domain application interface call interface, and supports at least one delivery semantics or exactly one delivery semantics during the distribution process. After completing the data distribution process, a confirmation or negative confirmation receipt containing error codes and location information is generated and sent back to the source security domain; When a negative acknowledgment is received or a timeout occurs, retransmission is performed according to the exponential backoff mechanism and the maximum retransmission count strategy, or the data is stored in the dead letter queue.

[0016] In one embodiment of the present invention, the method further includes: Key events in the entire transmission process, including data acquisition, envelope encapsulation, channel selection, isolated transmission, signature verification and decryption, classification and distribution, and receipt retransmission, are written into an audit ledger with hash anchoring and trusted timestamps. The control and monitoring platform aggregates link and task metrics from each logical transmission channel and performs visualized monitoring and compliance export of the transmission process based on centrally issued security policies.

[0017] To achieve the above objectives, a second aspect of the present invention provides a cross-security domain data synchronization system based on a message bus, comprising: The front-end exchange service module is used to collect raw data from the business system of the source security domain, perform sensitivity classification and channel level matching on the raw data according to the preset security policy, and encapsulate the processed data into a standardized message envelope containing routing information, security label and integrity verification value, and encrypt and digitally sign the standardized message envelope. The isolation control module is used to dynamically select a target transmission channel from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag in the standardized message envelope, and transmit the encrypted standardized message envelope across the security isolation boundary to the target security domain through the target transmission channel, and perform content security detection and traffic governance control during the transmission process. The post-exchange service module is used to verify the signature, integrity and timeliness of the received standardized message envelopes in the target security domain. After filtering duplicate data through an idempotent deduplication mechanism, it distributes the decrypted and recovered business data to the target business system and generates a transmission receipt. The control and monitoring platform is used to centrally distribute security policies and key materials, aggregate link indicators and task indicators of each logical transmission channel, and perform visual monitoring and auditing of the transmission process.

[0018] The embodiments of the present invention have the following beneficial effects: This invention eliminates single-path dependence and improves the continuity and stability of data transmission through multi-channel intelligent scheduling and dynamic path switching; it reduces the cost of heterogeneous system transformation and enhances versatility and scalability by using a unified message envelope model and multi-source data adaptation; it avoids the separation of security and transmission processes by embedding security protection into the transmission channel to achieve "on-the-fly inspection"; it constructs an end-to-end trusted delivery system through signature, verification, idempotent deduplication, and acknowledgment closed-loop mechanisms to ensure that data is tamper-proof and traceable; it ensures high system availability through a combination of channel health detection, lossless switching, and degradation strategies; and it meets the needs of large-scale operation and maintenance and compliance auditing through centralized policy management and visual monitoring. Attached Figure Description

[0019] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart illustrating a cross-security domain data synchronization method based on a message bus, provided as an embodiment of the present invention; Figure 2 This is a schematic diagram of the system layered deployment architecture provided in an embodiment of the present invention; Figure 3 This is a schematic diagram illustrating the functional composition of each module provided in an embodiment of the present invention; Figure 4 This is a structural diagram of a cross-security domain data synchronization system based on a message bus, provided as an embodiment of the present invention. Detailed Implementation

[0020] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0021] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0022] A cross-security domain data synchronization method based on a message bus, according to an embodiment of the present invention, is described below with reference to the accompanying drawings.

[0023] Example 1 This embodiment provides a cross-security domain data synchronization method based on a message bus, such as... Figure 1 As shown, the method includes the following steps: S1. Collect raw data from the business system of the source security domain, perform sensitivity classification and channel level matching on the raw data according to the preset security policy, and encapsulate the processed data into a standardized message envelope containing routing information, security labels and integrity verification values.

[0024] S2, the business data in the standardized message envelope is encrypted and digitally signed, and the target transmission channel is dynamically selected from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag.

[0025] S3, the encrypted standardized message envelope is transmitted across the security isolation boundary to the target security domain through the target transmission channel, and content security detection and traffic management control are performed during the transmission process.

[0026] S4 verifies the signature, integrity, and timeliness of the received standardized message envelopes in the target security domain. After filtering duplicate data through an idempotent deduplication mechanism, the decrypted and recovered business data is distributed to the target business system and a transmission receipt is generated.

[0027] like Figure 2 As shown, the system in this embodiment adopts a layered deployment architecture of "Front-end Switching Service (ES-A) - Isolation Control (IM) - Back-end Switching Service (ES-B)" to address isolation or quasi-isolation scenarios between source security domain A and target security domain B. Multi-channel policies and intelligent scheduling are introduced in the transmission plane; centralized policies and unified encryption auditing are implemented in the control plane; channel health detection and self-healing switching are configured in the availability plane; and multi-source data is uniformly carried in the data plane using a message envelope model. The system specifically includes: Front-end exchange service ES-A, responsible for data adaptation (supporting multiple data sources such as databases, files, message queues, and application programming interfaces), envelope encapsulation, policy matching and tagging, encryption signing, and sending proxy; Isolation control IM, responsible for channel orchestration and routing, health detection, content security and traffic governance, auditing and integrity anchoring, and one / two-way isolation interfaces; Back-end exchange service ES-B, responsible for signature verification and decryption, idempotency and deduplication, classification and distribution, receipts and retransmissions, local auditing and indicator reporting; and Control and monitoring platform COP, which serves as the policy center to centrally manage access control policies, data leakage prevention policies, white / black lists and rate thresholds, and is also responsible for key and certificate management, unified monitoring and alarms, audit ledgers, and evidence export.

[0028] like Figure 3 The diagram shows the functional sub-modules contained within the three main modules: ES-A, IM, and ES-B. In terms of structural connections, ES-A and IM, and IM and ES-B, are connected via controlled secure channels. The control interface uses either an HTTPS-based REST interface or a gRPC-based bidirectional streaming control interface. The data interface can be flexibly configured as a message bus interface, application programming interface, file exchange interface, or database exchange interface according to business needs. The COP distributes policies and key materials to each node through independent control channels and aggregates health, audit, and indicator information. Each transmission channel has a unique channel ID and security level identifier, and parameters such as bandwidth, latency, packet loss rate, and concurrency thresholds can be configured to support scheduling and compliance judgment.

[0029] The system works as follows: multi-source data is standardized and carried by message envelopes; the policy center assigns security labels and channel levels to data of different types and sensitivities; IM performs dynamic path selection and fault bypass or switching based on channel health status and policy matching results; ES-B ensures "at least once" or "exact once" delivery based on signature verification, integrity and timeliness checks, and idempotent deduplication, and forms end-to-end visualization, controllability and traceability through a closed loop of receipts.

[0030] Specifically, step S1 includes: In this embodiment, the front-end exchange service ES-A collects raw data from the business systems of the source security domain through a built-in multi-source data adaptation layer. The adaptation layer supports multiple data source access methods: for database type data, it captures changed data by parsing the database incremental logs; for file type data, it monitors a specified file directory and reads the content of newly added or modified files; for message queue data, it subscribes to specific topics to obtain message events; and for application programming interface data, it receives business requests through callback interfaces.

[0031] Further, the collected raw data enters the envelope encapsulation stage. The system constructs a unified message envelope model, Envelope, whose structure consists of three parts: message header, payload, and message metadata. The message header includes message identifier MsgID, sequence number Seq, source system identifier SourceID, destination system identifier DestID, schema identifier SchemaID, sensitivity level (divided into four levels from L0 to L3), channel class (divided into three levels from C1 to C3), time to live (TTL), timestamp, hash value, and acknowledgment mode AckMode. The message metadata includes routing hints, algorithm identifier, compression identifier, retransmission window size, and quality of service (QoS) constraints. The payload carries the serialized raw business data.

[0032] During the encapsulation process, the system performs sensitivity classification and channel level matching on the raw data according to a preset security policy. The specific matching logic is as follows: The system obtains the type, sensitivity level, source system identifier, destination system identifier, and business scenario characteristics of the raw data, and matches them with the access control policy, data leakage prevention policy, and whitelist / blacklist policy issued by the Control and Monitoring Platform (COP). Based on the matching results, the sensitivity level of the data is determined, and it is mapped to the channel level according to the principle that the data sensitivity must not exceed the channel's security carrying capacity. The mapping relationship is as follows: L0 level data is allowed to be transmitted through channels C1, C2, or C3; L1 level data is transmitted through at least channel C1; L2 level data is transmitted through at least channel C2; and L3 level data is only allowed to be transmitted through channel C3. If no suitable channel is currently available, the system suspends the transmission of the data and generates an alarm record, without performing automatic degradation transmission.

[0033] Specifically, step S2 includes: In this embodiment, after the envelope is encapsulated, the front-end exchange service ES-A performs encryption and digital signature processing on the message envelope. Specifically, the payload is encrypted using the AEAD encryption algorithm (such as GCM mode or the national cryptographic SM4-GCM algorithm) to ensure data confidentiality. Subsequently, a hash value is calculated for the message header or the entire envelope content, and the hash value is digitally signed using a private key, supporting certificate chain verification and timestamp verification to ensure data integrity and non-repudiation.

[0034] Next, ES-A submits the processed message envelope to the orchestrator of the Isolation Control IM, entering the channel selection and transmission phase. The system introduces an intelligent scheduling mechanism, dynamically selecting the target transmission channel based on the real-time health status score and security tag of each logical transmission channel. The Isolation Control IM periodically probes the network performance indicators of each logical transmission channel, including Round Trip Time (RTT), Packet Loss Rate (P), Availability (A), Throughput (T), and Error Rate (E). To eliminate the impact of network jitter on the evaluation results, the system uses the Exponentially Weighted Moving Average (EWMA) algorithm to smooth the probed indicator sample values. The calculation formula is as follows:

[0035] in, The index sample value at the current moment. This is the smoothed value from the previous time step. The smoothed value at the current moment. The smoothing coefficient is preferably in the range of 0.1 to 0.5.

[0036] After obtaining the smoothed values ​​of each indicator, the system standardizes them into scores. And combined with preset weights Calculate the health score for each logical transmission channel. Its expression is:

[0037] The system uses the calculated health score Based on the channel level requirements determined by the security label in the message envelope, the target transmission channel with the highest health score and that meets the channel level constraints is selected from multiple parallel transmission channels.

[0038] Furthermore, the system monitors the health score of the current main channel in real time. When the health score of the main channel falls below the switching threshold for multiple consecutive detection cycles, the system will initiate a switchover. The channel switching process is triggered on a timer. Switching threshold. The value is between 60 and 75. When a switchover is triggered, the system performs a lossless self-healing operation: freezing the new transmission window, retransmitting unacknowledged data fragments, and having the receiving end rearrange the order and perform idempotency checks based on message sequence numbers. If the health score of the original main channel is higher than the switchback threshold for several consecutive detection cycles... When this happens, the system automatically reverts to the original main channel operating state. Switchback threshold. The value is between 75 and 90 points, and a hysteresis threshold of 10 to 20 points is set between the cut-back threshold and the switching threshold. This is to prevent the channel state from oscillating frequently near the critical value.

[0039] Specifically, step S3 includes: In this embodiment, the encrypted standardized message envelope is transmitted to the target security domain across the security isolation boundary through the selected target transmission channel. During this process, the isolation control IM executes a dynamic security linkage mechanism of simultaneous transmission and inspection. Based on the message header, message metadata, and content characteristics in the envelope, it simultaneously performs access control, data leakage prevention detection, and traffic management control. Specifically, the IM rate-limits and shapes the passing data stream, matches it with whitelist rules, performs DLP detection on structured data and keywords, and monitors frequency thresholds. Once abnormal data, illegal traffic, or potential security threats are detected, the system immediately blocks transmission and records the security event, achieving synchronous linkage between security protection and data transmission.

[0040] Specifically, step S4 includes: In this embodiment, after receiving the standardized message envelope in the target security domain, the ES-B post-transfer service first verifies the digital signature of the message envelope based on the source certificate or pre-shared key, and performs integrity verification on the message digest or authentication tag to ensure that the data has not been tampered with during transmission. Secondly, it performs timeliness and clock deviation verification based on the timestamp and time-to-live (TTL) in the envelope. If the deviation between the current time and the envelope timestamp exceeds a preset threshold, or if the message has expired (exceeding the TTL), the data is directly rejected.

[0041] After successful verification, ES-B decrypts the payload according to the algorithm identifier in the envelope metadata, recovering the original business data. To ensure the reliability of data delivery, ES-B establishes an idempotent deduplication mechanism based on a sliding window: using the combination of the source system identifier SourceID, message identifier MsgID, and sequence number Seq as a unique key, it performs idempotency judgment and order control on processed or duplicate data. If signature verification fails, integrity verification fails, decryption is abnormal, or duplicate messages are detected, the system refuses to receive the data and generates an alarm record.

[0042] During the data distribution and acknowledgment processing phase, ES-B distributes the decrypted and recovered business data to the target business system based on the SchemaID or destination routing information in the standardized message envelope. Distribution targets include database write interfaces, file disk persistence interfaces, message bus interfaces, or target domain application interface calls. The system supports two types of delivery semantics: "at least once" and "exactly once." The "exactly once" delivery semantics can be implemented through two-phase commit, transactional messages, idempotent keys, or target-side idempotent write interfaces to ensure data consistency and traceability across domains.

[0043] After processing, ES-B generates a transmission receipt, containing either an ACK or NACK confirmation, along with the corresponding error code and location information, and sends it back to the source security domain's front-end switching service, ES-A. If ES-A receives a NACK confirmation or a timeout occurs, it performs a retransmission according to the exponential backoff mechanism and the maximum retransmission count strategy, or stores the data in a dead-letter queue for manual intervention. Retransmission waiting time. The calculation formula is:

[0044] in, This is the initial waiting time. This is the maximum waiting limit. This represents the number of retransmissions.

[0045] Furthermore, this embodiment also includes end-to-end auditing and visual monitoring capabilities. The Control and Monitoring Platform (COP) writes key events throughout the entire transmission process, including data acquisition, envelope encapsulation, channel selection, isolated transmission, signature verification and decryption, classification and distribution, and receipt retransmission, into an audit ledger with hash anchors and trusted timestamps, ensuring that audit records are tamper-proof and traceable. COP also aggregates link and task metrics from each logical transmission channel, and based on centrally issued access policies, data leakage prevention policies, rate policies, and routing policies, performs visual monitoring of the transmission process and supports the export of compliance reports.

[0046] It should be noted that this embodiment also supports the following alternatives: The front-end switching and isolation control can be merged into a two-layer integrated architecture, internally using dual network cards on the security domain side and the external connection side, and micro-segmentation technology to distinguish trust boundaries, suitable for scenarios where the number of devices is limited but rapid deployment is required; a multi-level chain relay mode can be adopted between multiple security domains, with each node performing local auditing and cleanup, suitable for large-scale data aggregation across multiple zones; a half-duplex time-slice plus dual unidirectional link mode can be adopted in a strong isolation environment, transmitting data in alternating directions according to time slots; for large file transmission, fragmented parallel transmission combined with RS erasure coding technology is supported, and single-channel multi-concurrency and fragment-based verification and retransmission can be enabled in weak network scenarios, while small files can be batched into archive frames to reduce handshake overhead; the internal message bus can use mainstream components such as Kafka, RabbitMQ, NATS, or Redpanda, and the external interface can be adapted to REST, gRPC, WebSocket, or industrial protocols such as IEC 104 and OPC. UA is designed to meet the current network needs of various industries. The system can be deployed as a standalone hardware box, virtual machine, or containerized cluster. Lightweight all-in-one machines can be used at edge sites, while cluster redundancy and partitioned replicas can be used for fault tolerance at the central site. In addition to channel health detection, MPTCP, QUIC multipath, or SR-IOV passthrough can be added to improve latency and jitter performance. FEC forward error correction can be used to reduce retransmission costs without modifying the link. In addition to lossless switching when the window is frozen, anomaly self-healing can be achieved through shadow channel preheating and dual-write comparison to achieve seamless migration. When multiple channels degrade simultaneously, read-only or write-only protection or gray-scale switching can be used to maintain core business. The centralized policy center can be replaced with distributed consistent storage or edge caching with tokenized verification. Policy distribution supports gray-scale and rollback windows. Structured fields can be reversibly or irreversibly desensitized and extracted with the minimum necessary set at the source. Only business-necessary fields are transmitted across domains, reducing DLP burden and leakage risk.

[0047] The encryption and signature algorithms in this embodiment can adopt national cryptographic standards, commercial cryptographic standards, or other equivalent cryptographic algorithm schemes. Any equivalent implementation path of "exactly once" falls within the protection scope of this invention. The health score indicator set, weights and EWMA coefficients, handover and backoff hysteresis thresholds, window size, number of fragments, timeout threshold, retransmission count, and exponential backoff parameters are all configurable and can be dynamically adjusted using statistical or learning strategies.

[0048] In summary, this embodiment achieves efficient and secure synchronization of multi-source heterogeneous data across security domains by constructing a layered system architecture and a unified message envelope model. By introducing a channel health scoring algorithm based on exponentially weighted moving averages and a dynamic scheduling mechanism, the system can intelligently select the optimal transmission path based on real-time network status and security policies, and achieve lossless self-healing switching in the event of link anomalies, significantly improving the continuity and reliability of transmission. The embedded edge-transmission and edge-inspection security linkage mechanism integrates access control, content inspection, and traffic governance into the entire transmission process, effectively preventing data leakage and unauthorized transmission. End-to-end signature verification, idempotent deduplication, and exponential backoff retransmission mechanisms ensure the accuracy and consistency of data delivery. The end-to-end audit ledger and visual monitoring capabilities meet the stringent requirements of high-security industries for traceable and compliant data flow.

[0049] Example 2 This invention also provides a cross-security domain data synchronization system based on a message bus, such as... Figure 4 As shown, the system 10 includes: The front-end switching service module 100 is used to collect raw data from the business system of the source security domain, perform sensitivity classification and channel level matching on the raw data according to the preset security policy, and encapsulate the processed data into a standardized message envelope containing routing information, security label and integrity verification value, and encrypt and digitally sign the standardized message envelope. The isolation control module 200 is used to dynamically select a target transmission channel from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag in the standardized message envelope, and transmit the encrypted standardized message envelope across the security isolation boundary to the target security domain through the target transmission channel, and perform content security detection and traffic governance control during the transmission process. The post-exchange service module 300 is used to verify the signature, integrity and timeliness of the received standardized message envelopes in the target security domain. After filtering duplicate data through an idempotent deduplication mechanism, it distributes the decrypted and recovered business data to the target business system and generates a transmission receipt. The control and monitoring platform 400 is used to centrally distribute security policies and key materials, aggregate link indicators and task indicators of each logical transmission channel, and perform visual monitoring and auditing of the transmission process.

[0050] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0051] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0052] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A cross-security domain data synchronization method based on a message bus, characterized in that, Includes the following steps: Raw data is collected from the business system in the source security domain. The raw data is then classified for sensitivity and matched with the channel level according to the preset security policy. The processed data is then encapsulated into a standardized message envelope containing routing information, security labels, and integrity verification values. The business data in the standardized message envelope is encrypted and digitally signed, and the target transmission channel is dynamically selected from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag. The encrypted standardized message envelope is transmitted across the security isolation boundary to the target security domain through the target transmission channel, and content security detection and traffic management control are performed during the transmission process; The target security domain verifies the signature, integrity, and timeliness of the received standardized message envelopes. After filtering duplicate data through an idempotent deduplication mechanism, the decrypted and recovered business data is distributed to the target business system and a transmission receipt is generated.

2. The method according to claim 1, characterized in that, The system collects raw data from the business system in the source security domain, performs sensitivity classification and channel level matching on the raw data according to a preset security policy, and encapsulates the processed data into a standardized message envelope containing routing information, security tags, and integrity verification values, including: Raw data is collected from the database incremental logs, file directories, message queues or application interface callbacks of the business system through a multi-source data adaptation layer. Construct a message header that includes message identifier, sequence number, source and destination identifiers, pattern identifier, sensitivity level, channel level, time to live, timestamp, hash value, and acknowledgment mode; and construct message metadata that includes routing hints, algorithm identifier, compression identifier, retransmission window, and quality of service constraints. The original data is used as the payload and combined with the message header and message metadata to form a standardized message envelope; Based on the principle that the data sensitivity must not exceed the channel's security carrying capacity, the sensitivity level is matched with the channel level. When no channel that meets the requirements is available, transmission is suspended and an alarm is generated.

3. The method according to claim 2, characterized in that, The matching of sensitivity levels and channel levels based on the principle that data sensitivity must not exceed the channel's security carrying capacity includes: Obtain the type, sensitivity level, source system identifier, destination system identifier, and business scenario characteristics of the raw data; The features are matched with a preset security policy, and the sensitivity level of the original data is determined based on the matching results. The sensitivity levels are mapped to corresponding channel levels, where low-sensitivity data is allowed to be transmitted through multiple channel levels, while high-sensitivity data is only allowed to be transmitted through the corresponding high-security channel.

4. The method according to claim 1, characterized in that, The process of encrypting and digitally signing the business data in the standardized message envelope, and dynamically selecting a target transmission channel from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag, includes: The payload in the standardized message envelope is encrypted, and a hash value is calculated for the standardized message envelope before digital signature is performed using a private key. Periodically detect the network performance indicators of each logical transmission channel and smooth the sampled values ​​of the detected indicators; The health score of each logical transmission channel is calculated based on the smoothed standardized scores of each indicator and the preset weights. The encrypted and signed message envelope is submitted to the isolation control module, which determines the required channel level based on the security label in the message envelope and selects the target transmission channel with the highest health score that meets the channel level requirements from multiple parallel transmission channels.

5. The method according to claim 4, characterized in that, The selection of the target transmission channel with the highest health score and meeting the channel level requirements from multiple parallel transmission channels includes: Real-time monitoring of the health score of the current main channel; when the health score of the current main channel is lower than the switching threshold for multiple consecutive detection cycles, the channel switching process is triggered. When the channel switching process is triggered, the new sending window is frozen and the unacknowledged data fragments are resent. The receiving end then performs order rearrangement and idempotency verification based on the message sequence number to achieve lossless self-healing. When the health score of the original main channel is higher than the cut-back threshold for several consecutive detection cycles, it automatically returns to the original main channel operation state, wherein a hysteresis threshold is provided between the cut-back threshold and the switching threshold.

6. The method according to claim 1, characterized in that, The process of transmitting the encrypted standardized message envelope across the security isolation boundary to the target security domain through the target transmission channel, and performing content security detection and traffic governance control during transmission, includes: The encrypted standardized message envelope is submitted to the isolation control module, which then forwards the data to the target security domain through the isolation interface. When data passes through the target transmission channel, access control, data leakage prevention detection, and traffic shaping control are performed based on the message header, message metadata, and content characteristics in the envelope. When abnormal data or illegal traffic is detected, the transmission is immediately blocked and the security event is logged.

7. The method according to claim 1, characterized in that, The process of verifying signatures, integrity, and timeliness of received standardized message envelopes in the target security domain, filtering duplicate data through an idempotent deduplication mechanism, distributing the decrypted and recovered business data to the target business system, and generating a transmission receipt includes: The received standardized message envelope is digitally signed and verified based on the source certificate or key, and the integrity of the message digest or authentication label is checked. The timeliness and clock deviation are checked based on the timestamp and lifespan in the envelope. If the deviation exceeds the preset threshold or the message has expired, it will be rejected directly. After the verification is passed, the payload is decrypted to restore the business data, and a sliding window deduplication mechanism is established with the source system identifier, message identifier and sequence number as unique keys to perform idempotency judgment and order control on processed or duplicate data. When signature verification fails, integrity verification fails, decryption fails, or duplicate messages are detected, the data will be rejected and an alarm record will be generated.

8. The method according to claim 7, characterized in that, The step of distributing the decrypted and recovered business data to the target business system and generating a transmission receipt includes: Based on the pattern identifier or destination routing information in the standardized message envelope, the decrypted and recovered business data is distributed to the database write interface, file disk interface, message bus interface or target domain application interface call interface, and supports at least one delivery semantics or exactly one delivery semantics during the distribution process. After completing the data distribution process, a confirmation or negative confirmation receipt containing error codes and location information is generated and sent back to the source security domain; When a negative acknowledgment is received or a timeout occurs, retransmission is performed according to the exponential backoff mechanism and the maximum retransmission count strategy, or the data is stored in the dead letter queue.

9. The method according to claim 1, characterized in that, The method further includes: Key events in the entire transmission process, including data acquisition, envelope encapsulation, channel selection, isolated transmission, signature verification and decryption, classification and distribution, and receipt retransmission, are written into an audit ledger with hash anchoring and trusted timestamps. The control and monitoring platform aggregates link and task metrics from each logical transmission channel and performs visualized monitoring and compliance export of the transmission process based on centrally issued security policies.

10. A cross-security domain data synchronization system based on a message bus, used to implement the method of any one of claims 1-9, characterized in that, include: The front-end exchange service module is used to collect raw data from the business system of the source security domain, perform sensitivity classification and channel level matching on the raw data according to the preset security policy, and encapsulate the processed data into a standardized message envelope containing routing information, security label and integrity verification value, and encrypt and digitally sign the standardized message envelope. The isolation control module is used to dynamically select a target transmission channel from multiple parallel transmission channels based on the real-time health status score of each logical transmission channel and the security tag in the standardized message envelope, and transmit the encrypted standardized message envelope across the security isolation boundary to the target security domain through the target transmission channel, and perform content security detection and traffic governance control during the transmission process. The post-exchange service module is used to verify the signature, integrity and timeliness of the received standardized message envelopes in the target security domain. After filtering duplicate data through an idempotent deduplication mechanism, it distributes the decrypted and recovered business data to the target business system and generates a transmission receipt. The control and monitoring platform is used to centrally distribute security policies and key materials, aggregate link indicators and task indicators of each logical transmission channel, and perform visual monitoring and auditing of the transmission process.

Images