A one-way data transmission system and method

Abstract

The application provides a one-way data transmission system and method, which comprises a sending side and a receiving side, and a one-way photoelectric coupler; the sending side comprises a first service master, a first optical network processing module and a first feedback processing module; the receiving side comprises a second optical network processing module, a second service master and a second feedback processing module; the one-way photoelectric coupler is connected with the second feedback processing module and the first feedback processing module respectively; if the input network data packet conforms to a preset white list, the first service master returns a protocol confirmation packet to a source IP address, and converts the network data packet into a plurality of UDP isolated protocol packets and sends them out; if the network data packet can be successfully restored according to the plurality of UDP isolated protocol packets, the second service master communicates with a destination IP address in the identity of the source IP address. The application reduces the risk of system reverse leakage, and is easy to access the existing environment.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more particularly to a one-way data transmission system and method. Background Technology

[0002] With the rapid development of the Industrial Internet, government cloud, and critical information infrastructure, the demand for data collaboration between networks of different security levels (such as classified internal networks and unclassified external networks) is increasing. However, traditional logical isolation devices (such as firewalls and VLANs) cannot defend against complex APT (Advanced Persistent Threat) attacks and low-level protocol penetration. Therefore, unidirectional isolation technology, which uses physical means to ensure that data can only flow in one direction, has become a mandatory requirement for high-security boundary protection. The core of this technology lies in using physical media (such as the unidirectional light emission characteristic of a single optical fiber) to cut off reverse electrical or optical path connections.

[0003] Existing technologies are mainly divided into two schools of thought: pure physical unidirectional optical gateways without feedback (blind transmission mode) and quasi-unidirectional network gateways with software protocol backhaul. To solve the serious packet loss problem caused by "blind transmission", the latter adds a restricted feedback channel (such as a restricted TCP ACK link) in the reverse link, allowing the receiver to send back the packet loss status or buffer full status to the sender through the operating system kernel protocol stack.

[0004] However, in existing systems with feedback mechanisms, the feedback channel is often directly managed by the main control CPU or the operating system. If the feedback protocol has vulnerabilities, or the operating system is compromised, attackers can construct malicious feedback messages or even use system clock jitter to build a covert reverse side channel, thereby stealing confidential data from the internal network and undermining the "absolutely one-way" security promise.

[0005] A blind transmission system without feedback cannot simulate a normal bidirectional TCP connection (such as a three-way handshake), making it unusable for standard network applications. Users must modify the source code of their business systems, call specific APIs, or develop specialized proxy software for adaptation, resulting in extremely high engineering deployment costs. Summary of the Invention

[0006] One of the objectives of this invention is to provide a one-way data transmission system and method that addresses at least some of the problems existing in the prior art.

[0007] The technical solution provided by this invention is as follows: A unidirectional data transmission system includes a transmitting side, a receiving side, and a unidirectional optocoupler; The transmitting side includes a first network processing module, a first service master control electrically connected to the first network processing module, and a first optical network processing module and a first feedback processing module electrically connected to the first service master control. The receiving channel of the first optical network processing module is hardware-disabled. The receiving side includes a second optical network processing module, a second service master control electrically connected to the second optical network processing module, a second network processing module and a second feedback processing module electrically connected to the second service master control, and the transmission channel of the second optical network processing module is hardware-disabled. The input end of the unidirectional optocoupler is connected to the second feedback processing module, and the output end is connected to the first feedback processing module. A unidirectional main data transmission link from the transmitting side to the receiving side is formed by the first optical network processing module and the second optical network processing module; a low-speed feedback link from the receiving side to the transmitting side is formed by the second feedback processing module, the unidirectional optocoupler and the first feedback processing module. The first service master controller obtains the input network data packet from the first network processing module; if the network data packet matches the preset whitelist, the first service master controller returns a protocol confirmation packet to the source IP address of the network data packet, and converts the network data packet into multiple UDP isolation protocol packets, which are then sent out through the first optical network processing module. The second service master controller receives the multiple UDP isolation protocol packets through the second optical network processing module; if the network data packet can be successfully restored based on the multiple UDP isolation protocol packets, the second service master controller communicates with the destination IP address using the source IP address of the network data packet.

[0008] In some embodiments, the first service controller uses DPDK technology to bypass the kernel, directly captures the input network data packets from the first network processing module, and extracts the first IP 5-tuple information from the network data packets; If the network data packet does not conform to the preset whitelist based on the first IP five-tuple information, the first service master controller discards the network data packet through DPDK; If the network data packet is determined to conform to the preset whitelist based on the first IP five-tuple information, the first service master control returns a protocol confirmation packet to the source IP address and stores the network data packet in the first cache queue; The first service master controller performs data segmentation on the network data packets, performs a first encoding on each data segment, and then encapsulates each encoded data segment into a UDP isolation protocol packet conforming to a predetermined format, and sends it out through the first optical network processing module.

[0009] In some embodiments, the second service master controller extracts the second IP 5-tuple information from the UDP isolation protocol packet; The second service master controller performs a first decoding verification on the UDP isolation protocol packet; the first decoding verification corresponds to the first encoding. If the verification fails, the second service master controller generates a first reverse error code based on the packet loss information of the second IP 5-tuple and sends it to the second feedback processing module. If the verification is successful, the second service master controller will store the UDP isolation protocol packet into the second cache queue.

[0010] In some embodiments, the second service master controller communicates with the destination IP address using the source IP address of the network data packet, including: If the destination IP address responds normally, the data delivery is complete; If the destination IP address is unreachable, a second reverse error code is generated and sent to the second feedback processing module.

[0011] In some embodiments, after receiving a first reverse error code or a second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send a specific low-speed pulse code to the transmitting side through its fixed hard-coded logic.

[0012] In some embodiments, after the first feedback processing module captures the specific low-speed pulse code sent by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller. The first service controller performs the corresponding processing based on the error code type.

[0013] In some embodiments, the first service controller performs corresponding processing based on the error code type, including: If the destination IP address is determined to be unreachable, the first service master controller sends a destination IP address unreachable response to the source host and forcibly closes the connection; If the packet loss is determined to be a link loss, the first service master controller will retrieve the data from the first cache queue and resend it.

[0014] In some embodiments, the transmitting side further includes a first low-frequency crystal oscillator connected to the first feedback processing module; the receiving side further includes a second low-frequency crystal oscillator connected to the second feedback processing module.

[0015] The present invention also provides a one-way data transmission method, applied to the one-way data transmission system described in the foregoing embodiments, comprising: When a received UDP isolation protocol packet is dropped, the second service master controller generates a first reverse error code based on the packet loss information and sends it to the second feedback processing module; When the second service master controller communicates with the destination IP address as the source host, if the destination IP address is unreachable, a second reverse error code is generated and sent to the second feedback processing module. Upon receiving the first or second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send a specific low-speed pulse code to the transmitting side through its fixed hard-coded logic. After the first feedback processing module captures the specific low-speed pulse code sent by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller. The first service controller performs the corresponding processing based on the error code type.

[0016] In some embodiments, including: The first service controller uses DPDK technology to bypass the kernel, directly captures the input network data packets from the first network processing module, and extracts the first IP 5-tuple information from the network data packets; If the network data packet does not conform to the preset whitelist based on the first IP five-tuple information, the first service master controller discards the network data packet through DPDK.

[0017] The unidirectional data transmission system and method provided by this invention can bring at least the following beneficial effects: 1. This invention achieves physical layer isolation between the transmitting and receiving sides by hardware-shutting down the receiving or transmitting channels of the optical network processing module and using an asymmetric hardware feedback circuit; the feedback link adopts pure hardware logic, eliminating software-level attacks and reducing the risk of reverse leakage.

[0018] 2. This invention enables users to directly access the system without modifying existing software (such as standard TCP application software) through system-level protocol simulation and transparent transmission capabilities, thus significantly shortening the project deployment cycle.

[0019] 3. This invention eliminates the performance loss caused by the kernel network stack by introducing the DPDK bypass kernel mechanism, improves line-speed performance, and approaches the physical bandwidth limit of gigabit / 10-gigabit links. Attached Figure Description

[0020] The preferred embodiments will be described below in a clear and easy-to-understand manner, with reference to the accompanying drawings, to further explain the above-mentioned characteristics, technical features, advantages, and implementation methods of a unidirectional data transmission system and method.

[0021] Figure 1 This is a schematic diagram of the structure of an embodiment of a one-way data transmission system of the present invention; Figure 2 This is a flowchart of an embodiment of a one-way data transmission method of the present invention; Figure 3 This is a schematic diagram of another embodiment of a unidirectional data transmission system according to the present invention. Detailed Implementation

[0022] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the specific implementation methods of the present invention will be described below with reference to the accompanying drawings. Obviously, the drawings described below are merely some embodiments of the present invention. For those skilled in the art, other drawings and other implementation methods can be obtained based on these drawings without any creative effort.

[0023] To keep the drawings concise, only the parts relevant to the invention are shown schematically in each figure, and they do not represent the actual structure of the product. Furthermore, for ease of understanding, in some figures, components with the same structure or function are shown only schematically, or only one is labeled. In this document, "a" can mean not only "only one" but also "more than one".

[0024] One embodiment of the present invention, such as Figure 1 As shown, a unidirectional data transmission system includes a transmitting side 10, a receiving side 20, and a unidirectional optocoupler 30.

[0025] The transmitting side includes a first network processing module 110, a first service master control 100 electrically connected to the first network processing module, and a first optical network processing module 120 and a first feedback processing module 130 electrically connected to the first service master control.

[0026] The first optical network processing module converts the electrically processed data into optical signals and couples them into the optical fiber for transmission. The receiving channel of the first optical network processing module is hardware-disabled. That is, the first optical network processing module only transmits and does not receive. Hardware shutdown means being forcibly shut down at the hardware level (not through software configuration). For example, the first optical network processing module includes a first optical module; the receiving channel of the first optical network processing module is hardware-disabled by physically disconnecting the receiving RX pin of the first optical module; alternatively, the receiving channel of the first optical network processing module can be forcibly shut down through hardware logic.

[0027] The receiving side includes a second optical network processing module 220, a second service master control 200 electrically connected to the second optical network processing module, and a second network processing module 210 and a second feedback processing module 230 electrically connected to the second service master control.

[0028] The second optical network processing module converts received optical signals into electrical data signals and sends them to the second service master controller. The transmission channel of the second optical network processing module is hardware-disabled. In other words, the second optical network processing module only receives signals and does not transmit. For example, the second optical network processing module includes a second optical module; the transmission channel of the second optical network processing module is hardware-disabled by physically disconnecting the transmit TX pin of the second optical module; alternatively, the transmission channel of the second optical network processing module can be forcibly shut down through hardware logic.

[0029] A unidirectional optocoupler is a semiconductor device that transmits electrical signals using light as a medium. Its key feature is that the signal can only be transmitted in a single direction (from the input to the output), and the reverse signal path is physically blocked. A second feedback processing module is connected to the input of the unidirectional optocoupler, and a first feedback processing module is connected to the output of the unidirectional optocoupler.

[0030] A unidirectional main data fiber optic transmission link is formed from the transmitting side to the receiving side through the first optical network processing module and the second optical network processing module; a low-speed feedback link is formed from the receiving side to the transmitting side through the second feedback processing module, the unidirectional optocoupler, and the first feedback processing module. The main data fiber optic transmission link and the low-speed feedback link are independent of each other.

[0031] Both the first network processing module and the second network processing module are physical network interface cards (NICs) used to receive or send network data packets.

[0032] The sending side performs the following operations: (1) The first service master control obtains the input network data packet from the first network processing module and extracts the first IP 5-tuple information from the network data packet. The IP 5-tuple information consists of five core fields used to uniquely identify a communication session in network communication, specifically including: source IP address, destination IP address, source port number, destination port number, and protocol type.

[0033] (2) Determine whether the network data packet conforms to the preset whitelist based on the first IP 5-tuple information; if it does not conform, discard the network data packet and clear the relevant session records (i.e. close the relevant sockets). Otherwise, return a protocol confirmation packet to the source IP address (source host) and store the network data packet in the first buffer queue on the sending side.

[0034] Whitelists can be flexibly configured according to security requirements. For example, a whitelist can include specific destination IP addresses and specific protocol types. By comparing against the whitelist, only external access to specific internal network servers is allowed, and only UDP protocol is permitted; all other protocols are blocked. Alternatively, a whitelist can include specific source IP addresses and specific destination IP addresses. By comparing against the whitelist, only terminals on specific network segments are allowed to access specific servers.

[0035] (3) The network data packets to be sent are converted into multiple UDP isolation protocol packets and sent out through the first optical network processing module. Specifically, the network data packets are split into multiple data fragments, each data fragment is first encoded (e.g., FEC encoding), and each encoded data fragment is then encapsulated into a UDP isolation protocol packet conforming to a predetermined format, and finally sent out through the first optical network processing module.

[0036] The receiving side performs the following operations: (1) The second service master controller receives UDP isolation protocol packets through the second optical network processing module and extracts the second IP 5-tuple information from the UDP isolation protocol packets. The source IP address and destination IP address of the current communication session can be obtained based on the second IP 5-tuple information.

[0037] (2) The second service master control performs a first decoding verification on the UDP isolation protocol packet; the first decoding verification corresponds to the first encoding. If the verification fails, the second service master control generates a first reverse error code based on the packet loss information of the second IP 5-tuple and sends it to the second feedback processing module. If the verification succeeds, the second service master control stores the UDP isolation protocol packet in the second buffer queue on the receiving side.

[0038] (3) The second service master extracts data from the second buffer queue and restores the corresponding network data packets according to multiple UDP isolation protocol packets. If the network data packets can be successfully restored, the source host communicates with the destination IP address; if the destination IP address responds normally, the data delivery is completed; if the destination IP address is unreachable, a second reverse error code is generated based on the destination IP address unreachable information and sent to the second feedback processing module.

[0039] (4) The second feedback processing module feeds back the first reverse error code or the second reverse error code to the first feedback processing module through a unidirectional optocoupler. Specifically, after receiving the first reverse error code or the second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send a specific low-speed pulse code to the transmitting side through its fixed hard-coded logic. This process does not go through the operating system on the receiving side, ensuring the security of the feedback path.

[0040] On the transmitting side, after the first feedback processing module captures the low-speed pulse code transmitted by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller; the first service master controller performs the corresponding processing according to the error code type.

[0041] In this embodiment, true physical layer isolation between the transmitting and receiving sides is achieved by hardware-shutting down the receiving or transmitting channels of the optical network processing module and by using an asymmetric hardware feedback circuit. The feedback link adopts pure hardware logic, eliminating software-level attacks and reducing the risk of reverse leakage. Through system-level protocol simulation and transparent transmission capabilities, users can directly access the system without modifying any existing software code, significantly shortening the engineering deployment cycle.

[0042] In one embodiment, the first business controller performs corresponding processing based on the error code type, including: If the destination IP address is determined to be unreachable, the first service master controller sends a destination IP address unreachable response to the source host and forcibly closes the connection; if the link is determined to be packet loss, the first service master controller retrieves the data from the first buffer queue and resends it.

[0043] If the error code type is the first reverse error code, it is determined that the link has lost packets. If the error code type is the second reverse error code, it is determined that the destination IP address is unreachable.

[0044] In one embodiment, the first service controller uses DPDK technology to bypass the kernel, directly captures the input network data packets from the first network processing module, and extracts the first IP 5-tuple information from the network data packets; if the network data packets do not conform to the preset whitelist based on the first IP 5-tuple information, the first service controller discards the network data packets through DPDK and cleans up the relevant session records (i.e. closes the relevant sockets).

[0045] Specifically, in traditional network data processing schemes, the sending and receiving of data packets heavily relies on the TCP / IP protocol stack of the operating system kernel (such as the Linux kernel). However, in high-speed network environments at gigabit or even 10-gigabit speeds, frequent context switching between kernel mode and user mode, as well as multiple memory copy operations, significantly consume CPU resources and introduce large transmission delays, resulting in the actual system throughput being far lower than the theoretical line speed of the physical link.

[0046] DPDK (Data Plane Development Kit) is an open-source, high-performance packet processing framework that provides a rich set of library functions and optimized drivers. Its core design philosophy is to bypass the operating system kernel and move network packet processing directly to user space, thereby effectively eliminating the overhead of switching between kernel and user modes and reducing the number of memory copies, achieving low-latency, high-throughput data forwarding.

[0047] This embodiment uses DPDK technology, which bypasses the operating system kernel on the sending side, allowing user-space processes to directly capture and process network data packets. This avoids the performance bottleneck of traditional kernel protocol stacks and provides strong support for high-speed transmission of service data, fully leveraging the hardware line-speed capabilities of gigabit / 10-gigabit networks.

[0048] In one embodiment, the transmitting side further includes a first low-frequency crystal oscillator connected to the first feedback processing module; the receiving side further includes a second low-frequency crystal oscillator connected to the second feedback processing module.

[0049] In this embodiment, a first low-frequency crystal oscillator drives the first feedback processing module, and a second low-frequency crystal oscillator drives the second feedback processing module. They do not share a clock with their respective system motherboards. This method of using an independent external clock to drive the feedback link can achieve absolute clock isolation and prevent hackers from using advanced techniques such as clock frequency drift to perform reverse penetration.

[0050] In one embodiment, the first feedback processing module and the second feedback processing module employ hardware feedback circuits such as FPGAs or combinational logic circuits, without including microinstruction sets or operating systems. This makes the feedback link immune to software-level protocol attacks.

[0051] In one embodiment, the two systems are powered by independent, isolated AC-DC power supplies with the ground wire completely disconnected. This allows for better physical layer isolation between the transmitting and receiving sides.

[0052] One embodiment of the present invention, such as Figure 2 As shown, a one-way data transmission method, applied to the one-way data transmission system described in the foregoing embodiments, includes: In step S110, when the received UDP isolation protocol packet is dropped, the second service master controller generates a first reverse error code based on the packet loss information and sends it to the second feedback processing module. Step S120: When the second service master controller communicates with the destination IP address as the source host, if the destination IP address is unreachable, a second reverse error code is generated and sent to the second feedback processing module. Step S130: After receiving the first reverse error code or the second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send a specific low-speed pulse code to the transmitting side through its fixed hard-coded logic. In step S210, after the first feedback processing module captures the specific low-speed pulse code sent by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller. Step S220: The first service controller performs the corresponding processing based on the error code type.

[0053] Specifically, when a received UDP isolation protocol packet fails verification or its IP 5-tuple information does not conform to the preset whitelist, the second service master controller discards the UDP packet and generates a first reverse error code based on the packet loss information, which is then fed back to the second feedback processing module. This allows the first service master controller to be notified via the feedback link to retransmit the corresponding network data packet. When the second service master controller communicates with a destination IP address, if the destination IP address is unreachable, for example, if no response is received from the destination host, a second reverse error code is generated and sent to the second feedback processing module.

[0054] Upon receiving the first or second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send the corresponding low-speed pulse level signal.

[0055] After the first feedback processing module captures the specific low-speed pulse code sent by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller.

[0056] The primary control unit performs corresponding processing based on the error code type, including: If the destination IP address is determined to be unreachable, the first service master controller sends a destination IP address unreachable response to the source host and forcibly closes the connection; if the link is determined to be packet loss, the first service master controller retrieves the data from the first buffer queue and resends it.

[0057] In one embodiment, the following steps precede step S110: Step S100: The second service master controller receives UDP isolation protocol packets through the second optical network processing module and extracts the second IP 5-tuple information from the UDP isolation protocol packets; Step S101: The second service master control performs a first decoding verification on the received UDP isolation protocol packet; the first decoding corresponds to the first encoding. Step S102 If the first decoding verification fails, the second service master controller discards the UDP isolation protocol packet and forms packet loss information based on the second IP 5-tuple information.

[0058] In one embodiment, it also includes: When a network data packet passes a preset check, the first service master controller returns a protocol confirmation packet to the source IP address and stores the network data packet in the first buffer queue.

[0059] In one embodiment, it also includes: In step S200, the first service master controller uses DPDK technology to bypass the kernel, directly captures the input network data packets from the first network processing module, and extracts the first IP 5-tuple information from the network data packets. If, in step S201, the network data packet does not conform to the preset whitelist based on the first IP five-tuple information, the first service master controller discards the network data packet through DPDK and clears the relevant session records.

[0060] If, in step S202, the network data packet is determined to conform to the preset whitelist based on the first IP five-tuple information, the first service master control returns a protocol confirmation packet to the source IP address and stores the network data packet in the first cache queue. In step S203, the first service master controller performs data fragmentation on the network data packets, performs first encoding on each data fragment, and then encapsulates each encoded data fragment into a UDP isolation protocol packet conforming to a predetermined format, and sends it out through the first optical network processing module.

[0061] It should be noted that the embodiments of the one-way data transmission system provided by this invention and the aforementioned embodiments of the one-way data transmission method are both based on the same inventive concept and can achieve the same technical effects. Therefore, other specific details of the embodiments of the one-way data transmission system can be found in the description of the aforementioned embodiments of the one-way data transmission method.

[0062] This invention also provides a specific application embodiment, such as Figure 3 As shown, a high-performance unidirectional data transmission system based on DPDK user-space driver and independent FPGA hardware logic isolation includes a transmitting side 10 and a receiving side 20, which are connected by independent main data fiber optic links and low-speed status feedback links.

[0063] The transmitting side 10 includes: a first service master controller 100, a first network processing module 110, a first optical network processing module 120, and a first large-capacity memory 140. The first optical network processing module includes a first optical network processing chip and a first optical module. The receive RX pin of the first optical module is physically disconnected. The first service master controller uses a multi-core MCU processor.

[0064] The receiving side 20 includes: a second optical network processing module 220, a second service controller 200, a second network processing module 210, and a second large-capacity memory 240. The second optical network processing module includes a second optical network processing chip and a second optical module. The transmit TX pin of the second optical module is physically disconnected. The second service controller uses a multi-core MCU processor.

[0065] Independent logic feedback channel: On the receiving side, an FPGA (or microcontroller) (i.e., the second feedback processing module 230) and an external independent low-frequency crystal oscillator (i.e., the second low-frequency crystal oscillator) are deployed independently of the main controller 200. On the transmitting side, an FPGA (or microcontroller) (i.e., the first feedback processing module 130) and an external independent low-frequency crystal oscillator (i.e., the first low-frequency crystal oscillator) are deployed independently of the main controller 100. The first feedback processing module 130 is connected to the GPIO interrupt pin of the transmitting side main controller 100. The second feedback processing module 230 is connected to the first feedback processing module 130 through a unidirectional optocoupler 30.

[0066] Both systems are powered by independent isolated AC-DC power supplies, with additional filtering circuits and the ground wire completely disconnected.

[0067] Data processing and transmission methods: By constructing virtual network protocol stacks on both the sending and receiving sides, and combining this with physical layer feedback, transparent data exchange in a one-way isolated environment is achieved. The specific steps are as follows: Step 1: User-space Protocol Interception and Filtering (Sender Side): The sender-side MCU (first service master controller) uses DPDK technology to bypass the kernel and directly capture raw Ethernet frames from the physical network card. The system extracts the IP 5-tuple information of the data packets and compares it with a preset whitelist. If the data packet does not conform to the whitelist rules, it is immediately discarded and the relevant socket is closed via DPDK; if it conforms, it enters the processing flow.

[0068] Step 2: Connection Simulation and Protocol Acknowledgment (Sender Side): To achieve "seamless" communication between the source host and the MCU, the sender-side MCU internally simulates the destination host's response behavior. While data is stored in the buffer queue, the MCU proactively returns a protocol acknowledgment packet (such as a TCP ACK or handshake response) to the source IP address to maintain the source host's connection status. Simultaneously, the original data packets undergo FEC (Forward Error Correction) encoding and data fragmentation, encapsulating them into dedicated UDP isolated protocol packets for transmission to the unidirectional fiber optic link.

[0069] Step 3: Data Restoration and Packet Loss Monitoring (Receiver Side): The receiver side receives UDP isolation packets via the optical module and performs FEC verification. If the verification detects data corruption that cannot be recovered by the error correction algorithm (i.e., packet loss has occurred), the system sends the error status (first error code) corresponding to the five-tuple to the second feedback processing module. If the data is complete, it is stored in the receiver side buffer queue.

[0070] Step 4: Data Reconstruction and Final Delivery (Receiving Side): Data in the receiving side's buffer queue is extracted by the receiving side MCU (second service master controller) and restored to the original protocol format, enabling real communication with the destination IP as the source host. If the destination IP responds normally, data delivery is complete; if the destination IP is unreachable, a second reverse error code is generated and sent to the second feedback processing module.

[0071] Step 5: Hardware-level reduced-dimensional feedback triggering (receiving side): After detecting packet loss or destination IP unreachable signals, the second feedback processing module drives a unidirectional optocoupler to send a specific low-speed pulse code (finite set error code) to the transmitting side through its fixed hard-coded logic. This process does not involve the receiving side's operating system, ensuring the absolute security of the feedback path.

[0072] Step 6: Feedback Interrupt Response and Connection Maintenance (Transmitting Side): After the first feedback processing module captures the specific low-speed pulse code transmitted by the unidirectional optocoupler, it parses the corresponding error code and triggers a hardware interrupt to the transmitting-side MCU via GPIO, notifying the transmitting-side MCU to retrieve the error code stored in the first feedback processing module. The first service master controller executes the following logic based on the error code type: 1. Abnormal Circuit Breaker: If the destination IP address is determined to be unreachable, a simulated "destination IP address unreachable" response is sent to the source host to forcibly close the connection.

[0073] 2. Reliable retransmission: If the data is determined to be lost in the link, it is retrieved from the local cache queue, encoded and sent again to ensure strong reliability of data transmission.

[0074] In this embodiment, the service data flow is achieved through high-speed forwarding using a high-performance CPU and DPDK software; the security feedback flow is implemented using an independent crystal oscillator and FPGA, with complete electrical and logical decoupling between the two. The feedback circuit does not share the motherboard clock but instead uses an FPGA in conjunction with an independent external low-frequency crystal oscillator. The FPGA does not contain any microinstruction set or operating system, only fixed combinational logic circuits. This design completely eliminates the possibility of side-channel data backhaul using clock frequency drift or buffer overflow vulnerabilities at the physical level. By establishing "shadow" protocol proxies at both ends of the unidirectional link, and utilizing the sender's advance response and the receiver's identity spoofing, the protocol feedback interruption problem caused by physical isolation is solved. Users can obtain a user experience consistent with standard networks in an absolutely isolated environment without modifying any software configuration.

[0075] This embodiment has the following technical effects: 1. Ultimate Security and Compliance: True physical layer isolation is achieved through physically removing the optical module's transceiver pins, dual-sided independent power supplies, and asymmetric hardware feedback circuitry. The feedback link is immune to any software-level protocol attacks, perfectly complying with advanced security review standards for Level 3 and above of the Information Security Protection System and for the isolation of classified networks.

[0076] 2. Breakthrough line-speed performance: By introducing the DPDK bypass kernel mechanism, the performance loss caused by the kernel network stack is eliminated. Real-world testing shows that when processing 64-byte small packets or Jumbo large frames, it can approach the physical bandwidth limit of gigabit / 10-gigabit links, with performance several times higher than traditional kernel-mode network gateways.

[0077] 3. High Availability and Zero Packet Loss: Through a composite mechanism of "low-frequency hardware pulse feedback + large-capacity memory buffer + forward error correction (FEC)," the pain point of "blind transmission and packet loss" in unidirectional links is perfectly solved. Even under network congestion, adaptive flow control can be achieved to ensure 100% integrity of business data.

[0078] 4. Extremely low engineering deployment cost: Thanks to system-level protocol simulation and transparent transmission capabilities, end users can directly connect without making any code modifications to existing industrial control systems, database synchronization software or video streaming platforms, which greatly shortens the engineering deployment cycle.

[0079] It should be noted that the above embodiments can be freely combined as needed. The above are merely preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A one-way data transmission system, characterized in that, Includes the transmitting and receiving sides, and unidirectional optocouplers; The transmitting side includes a first network processing module, a first service master control electrically connected to the first network processing module, and a first optical network processing module and a first feedback processing module electrically connected to the first service master control. The receiving channel of the first optical network processing module is hardware-disabled. The receiving side includes a second optical network processing module, a second service master control electrically connected to the second optical network processing module, a second network processing module and a second feedback processing module electrically connected to the second service master control, and the transmission channel of the second optical network processing module is hardware-disabled. The input end of the unidirectional optocoupler is connected to the second feedback processing module, and the output end is connected to the first feedback processing module. A unidirectional main data transmission link from the transmitting side to the receiving side is formed by the first optical network processing module and the second optical network processing module; a low-speed feedback link from the receiving side to the transmitting side is formed by the second feedback processing module, the unidirectional optocoupler and the first feedback processing module. The first service controller obtains the input network data packets from the first network processing module; If the network data packet matches the preset whitelist, the first service master controller returns a protocol confirmation packet to the source IP address of the network data packet, and converts the network data packet into multiple UDP isolation protocol packets, which are then sent out through the first optical network processing module. The second service master controller receives the multiple UDP isolation protocol packets through the second optical network processing module; If the network data packet can be successfully restored based on the multiple UDP isolation protocol packets, the second service master controller communicates with the destination IP address using the source IP address of the network data packet.

2. The unidirectional data transmission system according to claim 1, characterized in that, The first service controller uses DPDK technology to bypass the kernel, directly captures the input network data packets from the first network processing module, and extracts the first IP 5-tuple information from the network data packets; If the network data packet does not conform to the preset whitelist based on the first IP five-tuple information, the first service master controller discards the network data packet through DPDK; If the network data packet is determined to conform to the preset whitelist based on the first IP five-tuple information, the first service master control returns a protocol confirmation packet to the source IP address and stores the network data packet in the first cache queue; The first service master controller performs data segmentation on the network data packets, performs a first encoding on each data segment, and then encapsulates each encoded data segment into a UDP isolation protocol packet conforming to a predetermined format, and sends it out through the first optical network processing module.

3. The unidirectional data transmission system according to claim 2, characterized in that, The second service master controller extracts the second IP 5-tuple information from the UDP isolation protocol packet; The second service master controller performs a first decoding verification on the UDP isolation protocol packet; The first decoding verification corresponds to the first encoding; If the verification fails, the second service master controller generates a first reverse error code based on the packet loss information of the second IP 5-tuple and sends it to the second feedback processing module. If the verification is successful, the second service master controller will store the UDP isolation protocol packet into the second cache queue.

4. The unidirectional data transmission system according to claim 1, characterized in that, The second service master controller communicates with the destination IP address using the source IP address of the network data packet, including: If the destination IP address responds normally, the data delivery is complete; If the destination IP address is unreachable, a second reverse error code is generated and sent to the second feedback processing module.

5. The unidirectional data transmission system according to claim 3 or 4, characterized in that, Upon receiving the first or second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send a specific low-speed pulse code to the transmitting side through its fixed hard-coded logic.

6. The unidirectional data transmission system according to claim 5, characterized in that, After the first feedback processing module captures the specific low-speed pulse code sent by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller. The first service controller performs the corresponding processing based on the error code type.

7. The unidirectional data transmission system according to claim 6, characterized in that, The first service controller performs corresponding processing based on the error code type, including: If the destination IP address is determined to be unreachable, the first service master controller sends a destination IP address unreachable response to the source IP address and forcibly closes the connection; If the packet loss is determined to be a link loss, the first service master controller will retrieve the data from the first cache queue and resend it.

8. The unidirectional data transmission system according to claim 1, characterized in that, The transmitting side further includes a first low-frequency crystal oscillator connected to the first feedback processing module; the receiving side further includes a second low-frequency crystal oscillator connected to the second feedback processing module.

9. A one-way data transmission method, characterized in that, The system applied to the unidirectional data transmission system of claim 1 includes: When a received UDP isolation protocol packet is dropped, the second service master controller generates a first reverse error code based on the packet loss information and sends it to the second feedback processing module; When the second service master controller communicates with the destination IP address using the source IP address, if the destination IP address is unreachable, a second reverse error code is generated and sent to the second feedback processing module. Upon receiving the first or second reverse error code, the second feedback processing module drives the unidirectional optocoupler to send a specific low-speed pulse code to the transmitting side through its fixed hard-coded logic. After the first feedback processing module captures the specific low-speed pulse code sent by the unidirectional optocoupler, it parses out the corresponding error code and feeds it back to the first service master controller. The first service controller performs the corresponding processing based on the error code type.

10. The unidirectional data transmission method according to claim 9, characterized in that, include: The first service controller uses DPDK technology to bypass the kernel, directly captures the input network data packets from the first network processing module, and extracts the first IP 5-tuple information from the network data packets; If the network data packet does not conform to the preset whitelist based on the first IP five-tuple information, the first service master controller discards the network data packet through DPDK.

Images