CN106453389A - Network isolation method based on combination of firewall and gatekeeper - Google Patents

Abstract

The invention, which relates to the field of the firewall technology of the computer network information system as well as security isolation and information exchange technology, especially to the field of multi-system security interconnection, provides a network isolation method based on combination of a firewall and a gatekeeper. The method comprises two parts: gatekeeper type isolation and firewall type isolation. The method provided by the invention can be applied to a same network application scene and two kinds of different network isolation technologies including the firewall isolation technology and the gatekeeper isolation technology are realized, thereby meeting a complicated network isolation requirement.

Description

A Network Isolation Method Combining Firewall and Gatekeeper

technical field

The invention relates to the technical fields of firewall technology, security isolation and information exchange of computer network information systems, and in particular relates to multi-system security interconnection.

Background technique

Among traditional network isolation technologies, firewall technology and gatekeeper technology (security isolation and information exchange technology) are applicable to scenarios with different security requirements. Among them, because the firewall adopts a single machine and a single system, it is usually suitable for network isolation scenarios that require high communication performance and relatively low security requirements; and because the gatekeeper uses dual machines or multiple machines and multiple systems, special communication protocols are used for ferrying between systems. It is suitable for scenarios with relatively high security requirements and relatively low communication performance requirements. However, in more complex application scenarios, there may be two different network isolation requirements of a firewall and a gatekeeper at a single or multiple network connections. Therefore, a network isolation method that combines a firewall and a gatekeeper is required. .

Contents of the invention

In order to solve the above-mentioned technical problems, the object of the present invention is to provide a network isolation method combining a firewall and a gatekeeper, which can realize two different network isolation technologies of a firewall and a gatekeeper in the same network application scenario to apply More complex network isolation requirements.

In order to achieve the above object, the present invention adopts the following technical solutions:

A network isolation method combining a firewall and a network gatekeeper, the method is composed of a network gatekeeper mode isolation and a firewall mode isolation; the network gatekeeper mode isolation comprises the following steps:

①: The data exchange source of network A initiates access to the production network and connects to host A;

②: The traffic traction module of the host machine A pulls the data to the virtual host VM2, and the protocol reorganization module of the virtual host VM2 strips and reorganizes the data;

③: The VM2 of the host machine A is transmitted to the virtual host VM2 of the host machine B through the protocol isolation channel;

④: The protocol reorganization module of the virtual host VM2 restores the accepted data;

⑤: The data is transmitted to the B network to complete the secure interconnection;

The firewall mode isolation includes the following steps:

①: The data exchange source of network A initiates access to network B and connects to host A;

②: The host A traffic pulling module pulls the data to the virtual host VM1, and the firewall isolation module of the virtual host VM1 analyzes and filters the data;

③: The virtual host VM1 of host A is transmitted to the virtual host VM1 of host B through the protocol isolation channel;

④: The firewall isolation module of the virtual host VM1 analyzes and filters the received data;

⑤: The data is transmitted to the B network to complete the secure interconnection.

Because the present invention adopts the above-mentioned technical solution, the method can realize two different network isolation technologies of a firewall and a gatekeeper in the same network application scene, so as to be applicable to relatively complex network isolation requirements.

Description of drawings

Figure 1 is a schematic structural diagram of gatekeeper isolation.

FIG. 2 is a schematic structural diagram of firewall isolation.

detailed description

The specific implementation manner of the present invention will be described in detail below in conjunction with the accompanying drawings.

As shown in Fig. 1 and Fig. 2, a network isolation method combining a firewall and a gatekeeper is composed of a gatekeeper mode isolation and a firewall mode isolation.

As shown in Figure 1, the gatekeeper mode isolation includes the following steps:

①: The data exchange source of network A initiates access to the production network and connects to host A;

②: The traffic traction module of the host machine A pulls the data to the virtual host VM2, and the protocol reorganization module of the virtual host VM2 strips and reorganizes the data;

③: The VM2 of the host machine A is transmitted to the virtual host VM2 of the host machine B through the protocol isolation channel;

④: The protocol reconstruction module of the virtual host VM2 restores the accepted data;

⑤: The data is transmitted to the B network to complete the secure interconnection.

As shown in Figure 2, the firewall mode isolation includes the following steps:

①: The data exchange source of network A initiates access to network B and connects to host A;

②: The traffic pulling module of the host machine A pulls the data to the virtual host VM1, and the firewall isolation module of the virtual host VM1 analyzes and filters the data;

③: The virtual host VM1 of host A is transmitted to the virtual host VM1 of host B through the protocol isolation channel (non-protocol conversion);

④: The firewall isolation module of the virtual host VM1 analyzes and filters the received data;

⑤: The data is transmitted to the B network to complete the secure interconnection.

Claims (1)

1. a network isolation method that a firewall combines with a network gatekeeper, is characterized in that the method is composed of network gatekeeper mode isolation and firewall mode isolation; described network gatekeeper mode isolation comprises the following steps: ①: The data exchange source of network A initiates access to the production network and connects to host A; ②: The traffic traction module of the host machine A pulls the data to the virtual host VM2, and the protocol reorganization module of the virtual host VM2 strips and reorganizes the data; ③: The VM2 of the host machine A is transmitted to the virtual host VM2 of the host machine B through the protocol isolation channel; ④: The protocol reconstruction module of the virtual host VM2 restores the accepted data; ⑤: The data is transmitted to the B network to complete the secure interconnection; The firewall mode isolation includes the following steps: ①: The data exchange source of network A initiates access to network B and connects to host A; ②: The traffic pulling module of the host machine A pulls the data to the virtual host VM1, and the firewall isolation module of the virtual host VM1 analyzes and filters the data; ③: The virtual host VM1 of host A is transmitted to the virtual host VM1 of host B through the protocol isolation channel; ④: The firewall isolation module of the virtual host VM1 analyzes and filters the received data; ⑤: The data is transmitted to the B network to complete the secure interconnection.