CN111818057B - Relay distribution transmission system and method for network configuration data - Google Patents

Abstract

The invention discloses a system and method for relay distribution and transmission of network configuration data. In this solution, a centralized security management center is connected to an arbitration subsystem of a two-system security interconnection device, and the centralized security management center directly issues the configuration data of the arbitration subsystem. There is no direct data exchange path between the centralized security management center and the transmission subsystem. The configuration data of the transmission subsystem is issued by the centralized security management center to the arbitration system, and then the arbitration system relays it to the transmission subsystem through the internal isolation transmission system. This solution can more effectively improve the security of the configuration data of the transmission subsystem.

Description

A network configuration data relay distribution transmission system and method

technical field

The invention relates to network security technology, in particular to network isolation and interconnection technology of different levels of security domains.

Background technique

Governments, enterprises, organizations, etc. generally separate basic information/business networks from important information/business networks to protect the security of important information/business networks and internal data, but this also forms "information islands".

With the in-depth development of informatization, the realization of interconnection and information sharing between different levels of networks is one of the important themes of informatization development, and it also puts forward higher requirements for the security of cross-level network interconnection.

However, under the existing technology, simply deploying firewalls, security gateways and other devices at the network boundaries between different levels of systems cannot effectively solve the security problems of network interconnection. Factors such as the lack of necessary access control measures make it easy for security threats to cause damage to internal systems and data.

SUMMARY OF THE INVENTION

Aiming at the problems existing in the existing network interconnection technology between systems of different levels, the object of the present invention is to provide a system for relaying, distributing and transmitting network configuration data, and based on the system, a method for relaying, distributing and transmitting network configuration data is provided. This is to ensure the security of configuration data during resource access.

In order to achieve the above purpose, the network configuration data relay distribution transmission system provided by the present invention includes: two system security interconnection devices and a centralized security management center;

The safety interconnection device of the two systems includes an interconnection arbitration system, an interconnection subsystem, and an internal isolation transmission subsystem;

The interconnection arbitration system can arbitrate whether the interconnection access can be performed according to the security marks of the subject and object; a subject with credibility checking capability is introduced into the system, and by checking the subject, the object is dynamically adjusted so that the level of the subject and object is within While ensuring the confidentiality of the system, the integrity of the system is protected by using the credibility identification and constraints;

The interconnection subsystem combines trusted computing and adopts a whitelist mechanism to establish a communication path between security mechanisms that meets security requirements;

The internal isolated transmission subsystem is a system in which the interconnected parties perform credible authentication after the verification is successful, and the two parties establish an encrypted transmission mode after the authentication is passed;

The centralized safety management center formulates subject and object security marks for natural persons, safety protection equipment, key processes and modules in the application system, and converts the subject and object information in the application system according to certain conversion rules, and then synchronizes them to the second system In the safety interconnection device, the safety interconnection device of the second system implements mandatory access control according to the mark.

Further, the centralized security management center includes a background management page module, a data storage module, and a client agent module;

The background management page module is used to manage and configure the centralized security management center;

According to the needs of the business system, the data storage module determines the security level of all object resources in the system in combination with the importance of the object resources, and generates a global object mark list; at the same time, it determines the security mark of the subject according to the authority and role of the user in the business system, generate a list of global principal tokens;

The client agent module generates and executes subject-related policies according to the requirements of the centralized security management center, and executes relevant policies on corresponding computing nodes.

Further, the interconnection arbitration system includes a configuration data submodule, an information encapsulation submodule, an audit submodule, and a protocol conversion submodule;

The configuration data sub-module implements identity management, label management, authorization management and policy management for all subjects and objects;

The information encapsulation sub-module determines the identities of all legal users in the system, work keys and certificates and other security-related content;

The audit sub-module records the arbitration results of security mechanisms such as identity authentication and access control;

The protocol conversion sub-module establishes a corresponding encrypted transmission mode according to the adopted communication security mechanism.

Further, the interconnection subsystem includes an information encapsulation submodule and a protocol conversion submodule;

The information encapsulation sub-module determines the identities of all legal users in the system, work keys and certificates and other security-related content;

The protocol conversion sub-module establishes a corresponding encrypted transmission mode according to the adopted communication security mechanism;

The protocol conversion sub-module establishes a corresponding encrypted transmission mode according to the security-related content such as user identity, work key and certificate of the information encapsulation sub-module.

Further, the internal isolation transmission subsystem is composed of an external agent module, an internal agent module and an isolation component, and the external agent module is connected with the external information system to provide agency services for the interconnection between the external information system and the internal information system; the internal agent module is connected with the internal information system. The internal information system is connected to provide agency services for the interconnection between the internal information system and the external information system; the isolation component is connected to the internal agent module and the external agent module to provide policy execution for the interconnection of the two internal and external information systems.

In order to achieve the above purpose, the network configuration data relay distribution transmission method provided by the present invention includes:

(1) When the centralized management center distributes the user configuration data of the arbitration system, the centralized management center directly interacts with the arbitration subsystem to deliver the configuration management data;

(2) When the centralized management center sends the configuration data of the interconnection subsystem, the centralized management center interacts with the arbitration subsystem, and sends the configuration data of the interconnection subsystem to the arbitration subsystem. After the arbitration subsystem receives the configuration data of the interconnection subsystem, Send the configuration data of the interconnection subsystem to the interconnection subsystem through the internal isolation transmission subsystem;

(3) When the centralized management center releases the configuration data of the arbitration system and the interconnection subsystem at the same time, the centralized management center interacts with the arbitration subsystem, sends the configuration data of the arbitration subsystem and the interconnection subsystem to the arbitration subsystem, and the arbitration subsystem The system identifies the configuration data type, processes its own configuration data directly, interconnects the subsystem configuration data, and sends the configuration data of the interconnected subsystem to the interconnected subsystem through the internal isolation transmission subsystem.

The transmission scheme provided by the present invention through network configuration data relay distribution ensures that the configuration data of the interconnected subsystems of the two system security interconnection devices is relayed and distributed through the isolated transmission subsystem, which can more effectively improve the security of the configuration data of the transmission subsystem .

In this scheme, the centralized management center is connected to the arbitration subsystem of the safety interconnection device of the second system, and the centralized management center directly distributes the configuration data of the arbitration subsystem, and the centralized management center has no direct data with the transmission subsystem (ie, the interconnection subsystem) The interactive path, the configuration data of the transmission subsystem (that is, the interconnection subsystem), is issued by the centralized management center to the arbitration system, and then the arbitration system relay distributes it to the transmission subsystem through the internal isolation transmission system.

Description of drawings

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

Fig. 1 is the constituent schematic diagram of the network configuration data relay distribution transmission system in the example of the present invention;

Fig. 2 is the constituent schematic diagram of centralized safety management center in the example of the present invention;

Fig. 3 is a schematic diagram of the composition of the two-system safety interconnection device in the example of the present invention.

Detailed ways

In order to make the technical means, creative features, goals and effects achieved by the present invention easy to understand, the present invention will be further described below in conjunction with specific illustrations.

This example takes the access control of data exchange between networks with different security levels (low security domain and high security domain) as the starting point to build an effective and safe system configuration system to ensure the security of user configuration during resource access.

Referring to Fig. 1, it shows an example of the composition of the network configuration data relay distribution transmission system constituted according to this example.

This system is mainly composed of two system safety interconnection devices and a centralized safety management center, in which the second system safety interconnection device is used for two information systems (for example, internal information system and external information system) to establish a strict communication security mechanism (for example, information Stream one-way, two-way, etc.), and build corresponding encrypted transmission methods (for example, HTTPS, SFTP, IPsec, etc.) based on this security mechanism to prevent security functions from being bypassed and tampered with.

Furthermore, the centralized security management center formulates subject and object security marks for natural persons, security protection equipment, and key processes and modules in the application system, and converts the subject and object information in the application system according to certain conversion rules, and then synchronizes them to the secondary system. In the system safety interconnection device, the second system safety interconnection device implements mandatory access control according to the mark.

Specifically, as shown in Figure 2, the centralized security management center in this system is mainly composed of Browser, DB Base, and Manage Agent modules, which can realize functions such as system management, security management, and audit management.

As an example, the system management here formulates security marks of subject and object for natural persons, safety protection equipment, key processes and modules in the application system.

As an example, the security management here is mainly to convert the subject and object information in the application system according to a certain conversion rule, and then synchronize it to the existing security interconnection device of the two systems.

As an example, the audit management here is mainly to record the arbitration results of security mechanisms such as identity authentication and access control. The recorded content includes: event time, type, operation content, etc., to ensure cross-system and non-repudiation.

The Browser module in the centralized security management center refers to the background management page module of the centralized security management center, which is used to manage and configure the centralized security management center.

The DB Base module in the centralized security management center refers to the data storage module of the centralized security management center, which is used to determine the security level of all object resources in the system and generate a global object tag list according to the needs of the business system and in combination with the importance of object resources ; At the same time, according to the authority and role of the user in the business system, the security token of the subject is determined, and a global subject token list is generated.

The Manage Agent module in the centralized security management center refers to the client agent of the centralized security management center, which is used to generate and execute subject-related policies according to the requirements of the centralized security management center, including mandatory access control policies and level change policies, etc. The corresponding computing nodes implement a series of related policies such as file access control policies, network access control policies, regional border filtering policies, and firewall rules.

As shown in Figure 3, the security interconnection device of the two systems in this system specifically includes an interconnection arbitration system, an interconnection subsystem, and an internal isolation transmission subsystem, so that functions such as network security isolation, data verification, and interconnection behavior auditing can be realized.

The interconnection arbitration system here is used to arbitrate whether the interconnection access can be performed according to the security marks of the subject and the object. Introduce a subject with credibility checking capabilities into the system, and through checking the subject, dynamically adjust the object so that the level of the subject and object can protect the system by using the credibility identification and constraints while ensuring the confidentiality of the system. integrity.

The interconnection subsystem here is a system that combines trusted computing technology and adopts a whitelist mechanism to establish a communication path between security mechanisms that meets security requirements.

The internal isolated transmission subsystem here is a system in which the interconnected parties perform trusted authentication after successful verification, and the two parties establish an encrypted transmission mode after the authentication is passed. The system can guarantee the integrity and confidentiality of the transmitted data of both communication parties.

The two-system security interconnection device thus constituted can eliminate mutual interference between system components, establish a strict interactive structure, and prevent security functions from being bypassed and tampered with. During operation, firstly, the interconnection arbitration system judges whether the two information systems can be interconnected, and the interconnection subsystem judges which security mechanism is used for communication between the two information systems (for example, one-way information flow, two-way, etc.) , the encrypted transmission mode (for example, HTTPS, SFTP, IPsec, etc.) is established by the internal isolated transmission subsystem.

As an example, the interconnection arbitration system in this example includes a configuration data submodule, an information encapsulation submodule, an audit submodule, and a protocol conversion submodule.

The configuration data sub-module in this interconnected arbitration system implements identity management, label management, authorization management and policy management for all subjects and objects.

The information encapsulation sub-module in the interconnection arbitration system determines the identities, work keys, certificates and other safety-related content of all legal users in the system.

The audit sub-module in this interconnected arbitration system records the arbitration results of security mechanisms such as identity authentication and access control. The recorded content includes: event time, type, operation content, etc., to ensure cross-system and non-repudiation.

The protocol conversion sub-module in the interconnection arbitration system establishes a corresponding encrypted transmission mode (for example, HTTPS, SFTP, IPsec, etc.) according to the adopted communication security mechanism (for example, information flow one-way, two-way, etc.).

Further, the interconnection subsystem in this example includes an information encapsulation submodule and a protocol conversion submodule.

The information encapsulation sub-module in this interconnection subsystem determines the identities, work keys, certificates and other security-related content of all legal users in the system;

The protocol conversion sub-module in this interconnection subsystem establishes a corresponding encrypted transmission mode (for example, HTTPS, SFTP, IPsec, etc.) according to the communication security mechanism adopted (for example, information flow one-way, two-way, etc.).

When the interconnection subsystem thus constituted is in operation, the protocol conversion submodule establishes a corresponding encrypted transmission mode (for example, HTTPS, SFTP, IPsec, etc.) according to the user identity, work key and certificate of the information encapsulation submodule.

Furthermore, the internal isolated transmission subsystem in this example is used for credible authentication after successful verification of both parties to the interconnection, and the two parties establish an encrypted transmission mode after the authentication is passed. The system can guarantee the integrity and confidentiality of the transmitted data of both communication parties.

This internal isolated transmission subsystem can specifically protect the interconnection, intercommunication, and interoperability between two information systems, ensure the authenticity of user identities, operational security, and non-repudiation, and monitor information flow according to security policies. Strict control to ensure data security between the two information systems.

The internal isolated transmission subsystem is composed of an external agent module, an internal agent module and isolation components.

The external agent module is connected with the external information system to provide agency services for the interconnection between the external information system and the internal information system;

The internal agent module is connected with the internal information system to provide agency services for the interconnection between the internal information system and the external information system;

The isolation component is connected with the internal agent module and the external agent module to provide policy execution for the interconnection of the two internal and external information systems.

In the network configuration data relay distribution transmission system thus formed, the centralized security management center is connected to the arbitration subsystem of the security interconnection device of the second system, and the configuration data of the arbitration subsystem is directly issued by the centralized security management center, while the centralized security management center There is no direct data exchange path between the management center and the interconnection subsystem. The configuration data of the interconnection subsystem is sent to the arbitration system by the centralized security management center, and then the arbitration system is relayed to the interconnection subsystem through the internal isolation transmission system.

Therefore, the operation process of the network configuration data relay distribution transmission system is as follows:

(1) When the centralized management center distributes the user configuration data of the arbitration system, the centralized management center directly interacts with the arbitration subsystem to deliver the configuration management data;

(2) When the centralized management center sends the configuration data of the interconnection subsystem, the centralized management center interacts with the arbitration subsystem, and sends the configuration data of the interconnection subsystem to the arbitration subsystem. After the arbitration subsystem receives the configuration data of the interconnection subsystem, Send the configuration data of the interconnection subsystem to the interconnection subsystem through the internal isolation transmission subsystem;

(3) When the centralized management center releases the configuration data of the arbitration system and the interconnection subsystem at the same time, the centralized management center interacts with the arbitration subsystem, sends the configuration data of the arbitration subsystem and the interconnection subsystem to the arbitration subsystem, and the arbitration subsystem The system identifies the configuration data type, processes its own configuration data directly, interconnects the subsystem configuration data, and sends the configuration data of the interconnected subsystem to the interconnected subsystem through the internal isolation transmission subsystem.

In this way, the system can ensure that the configuration data of the interconnection subsystem of the secure interconnection device of the two systems is relayed and distributed through the isolated transmission subsystem, thereby improving the security of the configuration data of the transmission subsystem.

The implementation process of relaying, distributing and transmitting network configuration data based on this system for relaying, distributing and transmitting network configuration data will be described in detail below in conjunction with FIG. 1 .

The implementation process of relay distribution and transmission of network configuration data in this solution is as follows:

1) After the configuration management module of the centralized safety management center obtains the user configuration data, it interacts with the configuration data sub-module of the arbitration subsystem of the safety interconnection device of the second system.

2) The configuration data sub-module receives the configuration data and analyzes the configuration data type;

3) If the configuration data type is the configuration of the arbitration subsystem, the configuration data sub-module directly processes and configures the arbitration system;

4) If the configuration data type is the transmission subsystem, the configuration data sub-module repackages the configuration data (that is, is completed by the information packaging sub-module), and transmits it to the protocol conversion sub-module of the interconnection system through the protocol conversion sub-module, and the interconnection sub-module After the protocol conversion sub-module of the system receives the configuration data, it configures the interconnection subsystem;

5) If the configuration data type is a composite type, that is, there are both arbitration configuration data and interconnection subsystem configuration data, the arbitration subsystem parses the configuration data, extracts the arbitration subsystem configuration data to configure its own system, extracts the interconnection subsystem configuration data to repackage, and passes The protocol conversion module transmits to the protocol conversion module of the interconnection subsystem to configure the interconnection subsystem.

The foregoing has shown and described the basic principles, main features and advantages of the present invention. Those skilled in the industry should understand that the present invention is not limited by the above-mentioned embodiments. What are described in the above-mentioned embodiments and the description only illustrate the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will also have Variations and improvements are possible, which fall within the scope of the claimed invention. The protection scope of the present invention is defined by the appended claims and their equivalents.

Claims (6)

1. A network configuration data relay distribution transmission system, characterized in that it comprises: two system safety interconnection devices and a centralized safety management center; The safety interconnection device of the two systems includes an interconnection arbitration system, an interconnection subsystem, and an internal isolation transmission subsystem; The interconnection arbitration system can arbitrate whether the interconnection access can be performed according to the security marks of the subject and object; a subject with credibility checking capability is introduced into the system, and by checking the subject, the object is dynamically adjusted so that the level of the subject and object is within While ensuring the confidentiality of the system, the integrity of the system is protected by using the credibility identification and constraints; The interconnection subsystem combines trusted computing and adopts a whitelist mechanism to establish a communication path between security mechanisms that meets security requirements; The internal isolated transmission subsystem is a system in which the interconnected parties perform credible authentication after the verification is successful, and the two parties establish an encrypted transmission mode after the authentication is passed; The centralized safety management center formulates subject and object security marks for natural persons, safety protection equipment, key processes and modules in the application system, and converts the subject and object information in the application system according to certain conversion rules, and then synchronizes them to the second system In the safety interconnection device, the safety interconnection device of the second system realizes mandatory access control according to the mark; the centralized safety management center is connected with the interconnection arbitration system of the safety interconnection device of the second system, and the configuration data centralized management center of the interconnection arbitration system is directly downloaded There is no direct data interaction path between the centralized security management center and the interconnection subsystem. The configuration data of the interconnection subsystem is sent by the centralized security management center to the interconnection arbitration system, and then the interconnection arbitration system relays the transmission subsystem through the internal isolation. Distributed to interconnected subsystems. 2. The network configuration data relay distribution transmission system according to claim 1, wherein the centralized safety management center includes a background management page module, a data storage module, and a client agent module; The background management page module is used to manage and configure the centralized security management center; According to the needs of the business system, the data storage module determines the security level of all object resources in the system in combination with the importance of the object resources, and generates a global object mark list; at the same time, it determines the security mark of the subject according to the authority and role of the user in the business system, generate a list of global principal tokens; The client agent module generates and executes subject-related policies according to the requirements of the centralized security management center, and executes relevant policies on corresponding computing nodes. 3. The network configuration data relay distribution transmission system according to claim 1, wherein the interconnection arbitration system includes a configuration data submodule, an information encapsulation submodule, an audit submodule and a protocol conversion submodule; The configuration data sub-module implements identity management, label management, authorization management and policy management for all subjects and objects; The information encapsulation sub-module determines the identities, work keys and certificates of all legal users in the system and security-related content; The audit sub-module records the arbitration result of identity authentication and access control security mechanism; The protocol conversion sub-module establishes a corresponding encrypted transmission mode according to the adopted communication security mechanism. 4. The network configuration data relay distribution transmission system according to claim 1, wherein the interconnection subsystem comprises an information encapsulation submodule and a protocol conversion submodule; The information encapsulation sub-module determines the identities, work keys and certificates of all legal users in the system and security-related content; The protocol conversion sub-module establishes a corresponding encrypted transmission mode according to the adopted communication security mechanism; The protocol conversion sub-module establishes a corresponding encrypted transmission mode according to the user identity, work key, certificate and security-related content of the information encapsulation sub-module. 5. The network configuration data relay distribution transmission system according to claim 1, wherein the internal isolation transmission subsystem is composed of an external agent module, an internal agent module and an isolation component, and the external agent module and the external information system connected to provide proxy services for the interconnection between external information systems and internal information systems; the internal proxy module is connected to internal information systems to provide proxy services for the interconnection between internal information systems and external information systems; the isolation component is connected to internal proxy modules and external proxy modules to provide The internal and external two information systems are interconnected to provide policy execution. 6. A method for relaying, distributing and transmitting network configuration data, characterized in that the method is implemented based on the system for relaying, distributing and transmitting network configuration data according to any one of claims 1-5, comprising: (1) When the centralized management center distributes the user configuration data of the interconnected arbitration system, the centralized management center directly interacts with the interconnected arbitration system to issue the user configuration data; (2) When the centralized management center issues the configuration data of the interconnection subsystem, the centralized management center interacts with the interconnection arbitration system and sends the configuration data of the interconnection subsystem to the interconnection arbitration system. After the interconnection arbitration system receives the configuration data of the interconnection subsystem, Send the configuration data of the interconnection subsystem to the interconnection subsystem through the internal isolation transmission subsystem; (3) When the centralized management center issues the configuration data of the interconnection arbitration system and the interconnection subsystem at the same time, the centralized management center interacts with the interconnection arbitration system, and sends the configuration data of the interconnection arbitration system and the interconnection subsystem to the interconnection arbitration system, and the interconnection arbitration system The arbitration system identifies the configuration data type, processes its own configuration data directly, interconnects the subsystem configuration data, and sends the configuration data of the interconnected subsystem to the interconnected subsystem through the internal isolation transmission subsystem.

Images