CN106998333A - A kind of bilateral network security isolation system and method - Google Patents

Abstract

The invention discloses a two-way network security isolation system and method. The system includes an external network processing module, an internal network processing module and a transition area. The external network processing module is connected to the external network and processed with the internal network through a one-way data link. The modules are connected, the internal network processing module is connected to the internal network and connected to the transition area through a one-way data link with a switch, and the transition area is connected to the external network processing module through a one-way data link with a switch. When the external network sends data to the internal network, the external network processing module directly sends the external network data to the internal network processing module through a one-way data link; when the internal network sends data to the external network, the internal network processing module passes the one-way data link with a switch The link first sends the internal network data to the transition area for transition, and then the transition area sends the transition data to the external network processing module through a one-way data link with a switch. The invention can safely isolate networks of different security levels and ensure bidirectional data communication between networks of different security levels.

Description

A two-way network security isolation system and method

technical field

The invention relates to a two-way network security isolation system and method, belonging to the technical field of network security.

Background technique

With the popularization of Internet applications, network security is facing severe challenges, and various security incidents emerge in endlessly. Faced with this situation, for an organization's internal network, it is hoped that it can be connected to the Internet for information exchange, and avoid various network attacks from the Internet as much as possible. Under the defense of security equipment such as traditional firewalls and intrusion detection systems, network security isolation equipment has gradually revealed an important role.

The network security isolation device can isolate the connection between the organization's internal network and the external network, check the data flow in and out of the internal network, filter out malicious codes trying to enter the internal network, and sensitive information trying to flow out of the external network, and rely on the internal and external network Physical isolation and shielding of attacks based on network connections play an important role in protecting the organization's intranet.

Currently, there are two types of network security isolation devices: one-way and two-way. The one-way network security isolation device only allows external network data to enter the internal network, and does not allow internal network data to flow out of the external network, thus strictly ensuring that sensitive data in the internal network will not be leaked to the external network. The two-way network security isolation device allows two-way data flow between internal and external networks, and prevents the leakage of sensitive data through strict data content inspection.

The security of the one-way network security isolation device is based on the classic BLP security model, which can be proved to be safe under the BLP model, but the current two-way network security isolation device actually violates the BLP security model, and cannot be proved theoretically. The two-way network security isolation device is safe. Therefore, how to design a new two-way network security isolation system, which not only meets the requirements of the security model, but also realizes two-way data communication, has become a difficult point.

Contents of the invention

In view of the above shortcomings, the present invention provides a two-way network security isolation system and method, which can safely isolate networks with different security levels and ensure two-way data communication between networks with different security levels.

The technical scheme that the present invention solves its technical problem to take is:

A two-way network security isolation system of the present invention is characterized in that it includes an external network processing module, an internal network processing module, and a transition area, and the external network processing module is connected to the external network and processed with the internal network through a one-way data link The modules are connected, the internal network processing module is connected to the internal network and connected to the transition area through a one-way data link with a switch, and the transition area is connected to the external network processing module through a one-way data link with a switch.

Preferably, the external network processing module directly sends data to the internal network processing module through a one-way data link, and the internal network processing module sends data to the transition area through a one-way data link with a switch for transition, so The transition area sends transition data to the external network processing module through a one-way data link with a switch.

Preferably, the external network processing module includes an identity authentication module, an external network data cache area, an external network protocol conversion module, and a malicious code filtering module, and the identity authentication module is used to authenticate external network users, and if passed the authentication, allow The external network user logs in to the external network processing module, otherwise the connection request of the external network user is rejected; the external network data cache area is used to store the data sent by the external network to the internal network and the data sent by the internal network to the external network; the external network The protocol conversion module is used to analyze the application layer data in the network data packet sent from the external network to the internal network according to the TCP/IP protocol or package the data sent from the internal network to the external network according to the TCP/IP protocol into a network data packet; the malicious The code filtering module is used to detect malicious codes in the application layer data in the network data packets sent from the external network to the internal network and filter out possible malicious codes therein.

Preferably, the intranet processing module includes an intranet data cache area, an intranet protocol conversion module, and a sensitive information filtering module, and the intranet data cache area is used to store data sent from the external network to the intranet and data sent to the internal network by the intranet. The data of the external network; the internal network protocol conversion module is used to analyze the application layer data in the network packet sent to the external network by the internal network according to the TCP/IP protocol or send the external network to the internal network according to the TCP/IP protocol The data is packaged into a network data packet; the sensitive information filtering module is used to detect the sensitive information of the application layer data in the network data packet sent from the internal network to the external network and filter out the sensitive information that may exist therein.

Preferably, the transition area includes a transition data cache area, a system restore module and a data encryption module, the transition data cache area is used to store transition data when the internal network sends data to the external network; the data encryption module is used for The data sent from the internal network to the external network is encrypted; the system restore module is used to clear the data buffer area in the transition area and restore the transition area to the initial state.

A two-way network security isolation method of the present invention is characterized in that when the external network sends data to the internal network, the external network processing module directly sends the external network data to the internal network processing module through a one-way data link; When sending data, the internal network processing module first sends the internal network data to the transition area through the one-way data link with switch for transition, and then the transition area sends the transition data to the external network processing module through the one-way data link with switch .

Further, the process of sending data from the external network to the internal network includes the following steps:

Step 101: the external network user performs identity authentication to the identity authentication module in the external network processing module, if the authentication is passed, the external network user is allowed to log in to the network processing module, otherwise the connection request of the external network user is rejected;

Step 102: the external network user transmits the data to be sent to the internal network user to the external network processing module according to the TCP/IP protocol;

Step 103: The external network protocol conversion module parses the application layer data in the network data packet sent to the internal network user according to the TCP/IP protocol and stores it in the external network data cache area;

Step 104: the malicious code filtering module detects malicious codes on the application layer data in the external network data cache area, filters out possible malicious codes therein and then stores them in the external network data cache area;

Step 105: the external network processing module transmits the data in the external network data cache area filtered by the malicious code to the internal network processing module through a one-way data link;

Step 106: the intranet processing module stores the received data into the intranet data cache in the intranet processing module;

Step 107: the intranet protocol conversion module in the intranet processing module repackages the received data into a network data packet according to the TCP/IP protocol and sends it to the intranet user;

The process of sending data from the intranet to the extranet includes the following steps:

Step 201: the intranet user transmits the data that needs to be transmitted to the external network user to the intranet processing module according to the TCP/IP protocol;

Step 202: the internal network processing module stores the data to be transmitted to the external network user into the internal network data cache area of the internal network processing module;

Step 203: The intranet protocol conversion module parses the application layer data in the network data packet to be transmitted to the external network user according to the TCP/IP protocol and stores it in the intranet data cache area;

Step 204: The sensitive information filtering module in the intranet processing module performs sensitive information detection on the application layer data in the network data packet to be transmitted to the external network user in the intranet data buffer area, filters out the sensitive information that may exist therein, and then Stored in the intranet data cache;

Step 205: The intranet processing module closes the switch of the one-way data link with switch connected to the filtering area, and transmits the data in the intranet data cache area filtered by sensitive information to the transition zone;

Step 206: After the data transmission is completed, the intranet processing module disconnects the switch of the one-way data link with switch connected to the transition area;

Step 207: the transition area stores the received data into the transition data buffer area in the transition area;

Step 208: the data encryption module in the transition area randomly generates a data encryption key, encrypts the data in the transition data buffer area using a block encryption algorithm, and encrypts the encryption key of the data using the public key of the external network user;

Step 209: the transition area closes the switch of the unidirectional data link with switch connected to the external network processing module;

Step 210: the transition area sends the encrypted data and key together to the external network processing module through a one-way data link with a switch connected to the external network processing module;

Step 211: after the data has been sent, the transition area disconnects the switch of the unidirectional data link with the switch connected to the external network processing module, and simultaneously starts the system recovery module to clear the transition data buffer area in the transition area, and restores the transition area to initial state;

Step 212: the external network processing module stores the received data transmitted from the internal network user to the external network user into the external network data cache area in the external network processing module;

Step 213: the external network protocol conversion module in the external network processing module packs the data transmitted from the internal network user to the external network user in the external network data cache area into a network data packet according to the TCP/IP protocol and sends it to the external network user;

Step 214: After receiving the data, the external network user first decrypts the data encryption key with its own private key, and then decrypts the data with the data encryption key to obtain the data sent by the internal network user.

The beneficial effects of the present invention are:

The system of the present invention comprises an external network processing module, an internal network processing module and a transition area, wherein the external network processing module is connected with the internal network processing module through a one-way data link; the internal network processing module is connected with the internal network processing module through a one-way data link with a switch Transitional area connection; the transitional area is connected to the external network processing module through a one-way data link with a switch, and the two-way communication of data between networks with different security levels can be realized through dual one-way data links, and the system can be restored through the transitional area And data encryption operations to realize data flow from high security level internal network to low security level external network. The invention is used for safety isolation between networks with different safety levels, and ensures data safety under the premise of realizing data bidirectional communication.

The invention can not only safely isolate networks with different security levels and ensure two-way data communication between networks with different security levels, but also ensure system security and at the same time ensure the security of two-way data communication.

Description of drawings

The present invention will be described below in conjunction with the accompanying drawings.

FIG. 1 is a structural diagram of the two-way network security isolation system of the present invention.

detailed description

In order to clearly illustrate the technical features of this solution, the present invention will be described in detail below through specific implementation modes and in conjunction with the accompanying drawings. The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, components and arrangements of specific examples are described below. Furthermore, the present invention may repeat reference numerals and/or letters in different instances. This repetition is for the purpose of simplicity and clarity and does not in itself indicate a relationship between the various embodiments and/or arrangements discussed. It should be noted that components illustrated in the figures are not necessarily drawn to scale. Descriptions of well-known components and processing techniques and processes are omitted herein to avoid unnecessarily limiting the present invention.

As shown in Figure 1, a kind of two-way network security isolation system of the present invention, it comprises external network processing module, internal network processing module and transition area, described external network processing module accesses external network (with external network two-way communication) and Connect with the intranet processing module through a unidirectional data link, the intranet processing module accesses the intranet (two-way communication with the intranet) and connects with the transition area through a unidirectional data link with a switch, and the transition area passes The one-way data link with switch is connected with the external network processing module.

Preferably, the external network processing module directly sends data to the internal network processing module through a one-way data link, and the internal network processing module sends data to the transition area through a one-way data link with a switch for transition, so The transition area sends transition data to the external network processing module through a one-way data link with a switch.

Preferably, the external network processing module includes an identity authentication module, an external network data cache area, an external network protocol conversion module, and a malicious code filtering module, and the identity authentication module is used to authenticate external network users, and if passed the authentication, allow The external network user logs in to the external network processing module, otherwise the connection request of the external network user is rejected; the external network data cache area is used to store the data sent by the external network to the internal network and the data sent by the internal network to the external network; the external network The protocol conversion module is used to analyze the application layer data in the network data packet sent from the external network to the internal network according to the TCP/IP protocol or package the data sent from the internal network to the external network according to the TCP/IP protocol into a network data packet; the malicious The code filtering module is used to detect malicious codes in the application layer data in the network data packets sent from the external network to the internal network and filter out possible malicious codes therein.

Preferably, the intranet processing module includes an intranet data cache area, an intranet protocol conversion module, and a sensitive information filtering module, and the intranet data cache area is used to store data sent from the external network to the intranet and data sent to the internal network by the intranet. The data of the external network; the internal network protocol conversion module is used to analyze the application layer data in the network packet sent to the external network by the internal network according to the TCP/IP protocol or send the external network to the internal network according to the TCP/IP protocol The data is packaged into a network data packet; the sensitive information filtering module is used to detect the sensitive information of the application layer data in the network data packet sent from the internal network to the external network and filter out the sensitive information that may exist therein.

Preferably, the transition area includes a transition data cache area, a system restore module and a data encryption module, the transition data cache area is used to store transition data when the internal network sends data to the external network; the data encryption module is used for The data sent from the internal network to the external network is encrypted; the system restore module is used to clear the data buffer area in the transition area and restore the transition area to the initial state.

The external network processing module of the present invention is connected with the internal network processing module through a one-way data link, that is, only data is allowed to enter the internal network processing module from the external network processing module through the one-way data link; The one-way data link is connected to the transition area, that is, only data is allowed to enter the transition area from the internal network processing module through the one-way data link with switch; the transition area is connected to the external network processing module through the one-way data link with switch , that is, only allow data to enter the external network processing module through the one-way data link with switch from the transition area; the present invention designs a new two-way network security isolation system on the basis of the current two-way network security isolation system architecture, both It meets the requirements of the security model and can realize two-way data communication.

A two-way network security isolation method of the present invention, when the external network sends data to the internal network, the external network processing module directly sends the external network data to the internal network processing module through a one-way data link; when the internal network sends data to the external network The internal network processing module first sends the internal network data to the transition area for transition through the one-way data link with switch, and then the transition area sends the transition data to the external network processing module through the one-way data link with switch.

Further, the process of sending data from the external network to the internal network (that is, when the user in the external network needs to transmit data to the internal network user) includes the following steps:

Step 101: the external network user performs identity authentication to the identity authentication module in the external network processing module, if the authentication is passed, the external network user is allowed to log in to the network processing module, otherwise the connection request of the external network user is rejected;

Step 102: the external network user transmits the data to be sent to the internal network user to the external network processing module according to the TCP/IP protocol;

Step 103: The external network protocol conversion module parses the application layer data in the network data packet sent to the internal network user according to the TCP/IP protocol and stores it in the external network data cache area;

Step 104: the malicious code filtering module detects malicious codes on the application layer data in the external network data cache area, filters out possible malicious codes therein and then stores them in the external network data cache area;

Step 105: the external network processing module transmits the data in the external network data cache area filtered by the malicious code to the internal network processing module through a one-way data link;

Step 106: the intranet processing module stores the received data into the intranet data cache in the intranet processing module;

Step 107: The intranet protocol conversion module in the intranet processing module repackages the received data into a network data packet according to the TCP/IP protocol and sends it to the intranet user.

The process of sending data from the internal network to the external network (that is, when the user in the internal network needs to transmit data to the external network user) includes the following steps:

Step 201: the intranet user transmits the data that needs to be transmitted to the external network user to the intranet processing module according to the TCP/IP protocol;

Step 202: the internal network processing module stores the data to be transmitted to the external network user into the internal network data cache area of the internal network processing module;

Step 203: The intranet protocol conversion module parses the application layer data in the network data packet to be transmitted to the external network user according to the TCP/IP protocol and stores it in the intranet data cache area;

Step 204: The sensitive information filtering module in the intranet processing module performs sensitive information detection on the application layer data in the network data packet to be transmitted to the external network user in the intranet data buffer area, filters out the sensitive information that may exist therein, and then Stored in the intranet data cache;

Step 205: The intranet processing module closes the switch of the one-way data link with switch connected to the filtering area, and transmits the data in the intranet data cache area filtered by sensitive information to the transition zone;

Step 206: After the data transmission is completed, the intranet processing module disconnects the switch of the one-way data link with switch connected to the transition area;

Step 207: the transition area stores the received data into the transition data buffer area in the transition area;

Step 208: The data encryption module in the transitional area randomly generates a data encryption key, encrypts the data in the transitional data buffer area using a block encryption algorithm (such as the AES algorithm), and encrypts the data in the external network user's public key encryption key;

Step 209: the transition area closes the switch of the unidirectional data link with switch connected to the external network processing module;

Step 210: the transition area sends the encrypted data and key together to the external network processing module through a one-way data link with a switch connected to the external network processing module;

Step 211: after the data has been sent, the transition area disconnects the switch of the unidirectional data link with the switch connected to the external network processing module, and simultaneously starts the system recovery module to clear the transition data buffer area in the transition area, and restores the transition area to initial state;

Step 212: the external network processing module stores the received data transmitted from the internal network user to the external network user into the external network data cache area in the external network processing module;

Step 213: the external network protocol conversion module in the external network processing module packs the data transmitted from the internal network user to the external network user in the external network data cache area into a network data packet according to the TCP/IP protocol and sends it to the external network user;

Step 214: After receiving the data, the external network user first decrypts the data encryption key with its own private key, and then decrypts the data with the data encryption key to obtain the data sent by the internal network user.

The present invention realizes the two-way communication of data between networks of different security levels through double unidirectional data links, and realizes the flow of data from the internal network with high security level to the external network with low security level through the system restoration and data encryption operation in the transition area. Data security is ensured on the premise of realizing two-way data communication, which can be applied to security isolation between networks with different security levels.

The above is only a preferred embodiment of the present invention. For those of ordinary skill in the art, without departing from the principle of the present invention, some improvements and modifications can also be made, and these improvements and modifications are also considered as the present invention. protection scope of the invention.

Claims (7)

1. a kind of bilateral network security isolation system, it is characterized in that, including outer net processing module, Intranet processing module and transition region Domain, the outer net processing module accessing external network is simultaneously connected by unidirectional data link with Intranet processing module, the Intranet processing Module accesses Intranet and is connected by the unidirectional data link of belt switch with transitional region, and the transitional region passes through belt switch Unidirectional data link is connected with outer net processing module.

2. a kind of bilateral network security isolation system according to claim 1, it is characterized in that, the outer net processing module is led to Cross unidirectional data link and data are transmitted directly to Intranet processing module, the unidirectional number that the Intranet processing module passes through belt switch Transitional region is sent the data to according to link and carries out transition, and the transitional region is by the unidirectional data link of belt switch by transition Data are sent to outer net processing module.

3. a kind of bilateral network security isolation system according to claim 1 or 2, it is characterized in that, the outer net handles mould Block includes authentication module, outer net data buffer area, outer net protocol conversion module and malicious code filtering module, the identity Authentication module allows external user to log in outer net processing mould to carry out authentication to external user if by certification Block, otherwise refuses the connection request of external user；The outer net data buffer area is sent to the data of Intranet to store outer net The data of outer net are sent to Intranet；The outer net protocol conversion module to outer net according to ICP/IP protocol to issue Intranet Application layer data is parsed or the data that Intranet is sent to outer net is packaged as into net according to ICP/IP protocol in network packet Network packet；Application layer data is disliked in network packet of the malicious code filtering module to issue Intranet to outer net Meaning code detection simultaneously filters out malicious code wherein that may be present.

4. a kind of bilateral network security isolation system according to claim 1 or 2, it is characterized in that, the Intranet handles mould Block includes intranet data buffer area, Intranet protocol conversion module and sensitive information filtering module, and the intranet data buffer area is used The data and Intranet of Intranet are sent to store outer net and are sent to the data of outer net；The Intranet protocol conversion module be used to according to ICP/IP protocol is issued application layer data in the network packet of outer net to Intranet and parsed or will be outer according to ICP/IP protocol The data that net is sent to Intranet are packaged as network packet；Net of the sensitive information filtering module to issue outer net to Intranet Application layer data carries out sensitive information detection and filters out sensitive information wherein that may be present in network packet.

5. a kind of bilateral network security isolation system according to claim 1 or 2, it is characterized in that, the transitional region bag Transit data buffer area, system reducing module and data encryption module are included, the transit data buffer area is sent out to storing intranet Give transit data during outer network data；The data encryption module is encrypted to be sent to the data of outer net to Intranet； The system reducing module is to empty the data buffer area in transitional region and transitional region is reduced into original state.

6. a kind of bilateral network security isolation method, it is characterized in that, outer net passes through to outer net processing module during Intranet transmission data Outer network data is transmitted directly to Intranet processing module by unidirectional data link；Intranet to outer net send data when Intranet processing module Intranet data is first sent to by the unidirectional data link of belt switch by transitional region and carries out transition, then transitional region passes through band Transit data is then forwarded to outer net processing module by the unidirectional data link of switch.

7. a kind of bilateral network security isolation method according to claim 6, it is characterized in that,

The process that the outer net sends data to Intranet comprises the following steps：

Step 101：Authentication module of the external user into outer net processing module carries out authentication, if by certification Allow external user logging in network processing module, otherwise refuse the connection request of external user；

Step 102：External user will be sent to the data of Intranet user to outer net processing module according to ICP/IP protocol transmission；

Step 103：Outer net protocol conversion module will be sent in the network packet of Intranet user according to ICP/IP protocol and apply Layer data parses and is stored in outer net data buffer area；

Step 104：Application layer data in the external network data buffer area of malicious code filtering module carries out Malicious Code Detection, mistake Outer net data buffer area is restored again into after filtering malicious code wherein that may be present；

Step 105：Data in the outer net data buffer area that outer net processing module will be filtered by malicious code are by unidirectionally counting Intranet processing module is given according to link transmission；

Step 106：The data received are stored in the intranet data buffer area in Intranet processing module by Intranet processing module；

Step 107：Intranet protocol conversion module in Intranet processing module beats the data received according to ICP/IP protocol again Wrap to be sent to Intranet user after network packet；

The process that the Intranet sends data to outer net comprises the following steps：

Step 201：The data that Intranet user will need to be transferred to external user are transferred to Intranet processing mould according to ICP/IP protocol Block；

Step 202：The intranet data that Intranet processing module will be transferred to the data deposit Intranet processing module of external user delays Deposit area；

Step 203：Intranet protocol conversion module will be transferred in the network packet of external user according to ICP/IP protocol should Parsed with layer data and be stored in intranet data buffer area；

Step 204：Sensitive information filtering module in Intranet processing module in intranet data buffer area to that will be transferred to outer net Application layer data carries out sensitive information detection in the network packet of user, filters out after sensitive information wherein that may be present again It is stored in intranet data buffer area；

Step 205：Intranet processing module closes the switch of the unidirectional data link for the belt switch being connected with filtration zone, will be through The data crossed in the intranet data buffer area of sensitive information filtering are transferred to transitional region by the unidirectional data link of belt switch；

Step 206：Intranet processing module finishes data transfer on the one-way data chain for disconnecting the belt switch being connected with transitional region The switch on road；

Step 207：The data received are stored in the transit data buffer area in transitional region by transitional region；

Step 208：Data encryption module in transitional region generates a data encryption key at random, uses block encryption algorithm Data in transit data buffer area are encrypted, and use the encryption key of the public key encryption of the external user data；

Step 209：The switch of the unidirectional data link for the belt switch that transitional region closure is connected with outer net processing module；

Step 210：Data and key after encryption are together passed through the belt switch that is connected with outer net processing module by transitional region Unidirectional data link is sent to outer net processing module；

Step 211：Data are sent, and transitional region disconnects the unidirectional data link for the belt switch being connected with outer net processing module Switch, while activation system recovery module empties the transit data buffer area in transitional region, and transitional region is reduced to Original state；

Step 212：The data that the Intranet user received is transferred to external user are stored in outer net processing module by outer net processing module In outer net data buffer area；

Step 213：Outer net protocol conversion module in outer net processing module is according to ICP/IP protocol by outer net data buffer area The data that Intranet user is transferred to external user are packaged as after network packet being sent to external user；

Step 214：External user is received after data, first with the private key ciphertext data encryption key of oneself, then close with data encryption Key ciphertext data, obtains the data that Intranet user is sent.