TWI673973B - Physically isolated network transport system - Google Patents

Abstract

The invention is an entity-isolated network transmission system, which is suitable for being disposed between a data demand end and a data providing end, the data demand end is used to output a demand data, and the data supply end is used according to the demand data to Outputting a provided data, the transmission system of the physical network isolation includes a first server, a first proxy server, a first unidirectional gateway, a second proxy server, a second server, A third proxy server, a second unidirectional gateway, and a fourth proxy server are connected to each other through the above servers and transmit internal data in one direction; thereby, the possibility of software vulnerabilities is eliminated. The nature and data can be exchanged without reducing the purpose of security protection.

Description

Physically isolated network transmission system

The present invention relates to a network transmission system, particularly a physically isolated network transmission system.

The widespread application of the Internet and information technology has greatly changed the traditional business model and environment, and also changed people's work and lifestyle. The Internet has also promoted the rise of e-commerce, entertainment and the community. These innovations in addition to In addition to opening up many business opportunities, it also has a great impact on the lives of modern people.

The importance of information security is becoming more and more important with the development of information. As shown in Figure 1, it is a general traditional security security architecture1. Most of them use software or hardware firewalls 10 to solve this problem, such as a packet filtering firewall. The packet filtering firewall has the function of stateful packet detection. This function can detect the packet header. The disadvantage is that it is difficult to design a set of long-term effective and correct error-free filtering rules and unable to process application layer agreements. Weak work and methods are powerless. The other is a stateful inspection firewall. The stateful inspection firewall not only monitors network transmissions in a similar way to packet filtering, but also further examines the content and behavior of packet data streams. However, the stateful inspection firewall performs slightly worse than the packet filtering firewall. , And cannot handle application-level agreements. Although the above-mentioned firewall can prevent the invasion of network viruses, it still cannot effectively block the rapidly changing virus attacks, and there is a crisis that may cause large-scale poisoning.

In addition, the devices controlled by the computer are becoming more and more complicated. The devices usually need to be updated and the data is exchanged more frequently. The firewall becomes more and more unreliable. There are two modes when the computer administrator performs the update action. The first mode is to interrupt the network and go to the site in person to perform the update. Not only is it a waste of time, the labor cost will also increase relatively. The second mode is to The device is connected to the network for remote operation or the vendor updates the device. As a result, the network end is exposed to a high-risk environment. Attack viruses have the opportunity to penetrate the firewall to the network end. Therefore, the traditional protection mechanism has been unable to meet the ever-changing various security risks.

In view of the shortcomings of the above-mentioned conventional technologies, the present invention provides a physically-isolated network transmission system, which is mainly to prevent the possibility of software vulnerabilities and data from being exchanged with each other without reducing the security protection.

An embodiment of the present invention provides a physically isolated network transmission system, which is suitable for being disposed between a data demand end and a data providing end.

The data demand end is used to output a demand data, and the data supply end is used to output a provide data according to the demand data. The physical network isolation transmission system includes a first server and a first proxy server. A first unidirectional gateway, a second proxy server, a second server, a third proxy server, a second unidirectional gateway, and a fourth proxy server.

The first server has a first server end, a first transmitting end, and a first receiving end connected to the data demand end. The first server end can receive the demand data output by the data demand end and The demand data is coded into a first coded data, and the first coded data is output by the first transmitting end.

The first proxy server is connected to the first transmitting end of the first server, receives the first encoded data output from the first transmitting end, and encodes the first encoded data into a second encoded data.

The first unidirectional gateway has a first input terminal connected to the first proxy server and a first output terminal, and the first input terminal receives the second encoded data output by the first proxy server. And output the second encoded data from the first output terminal.

The second proxy server is connected to the first output end of the first unidirectional gateway, receives the second encoded data output from the first output end, and decodes and restores the second encoded data into the first Encoding information.

The second server is provided between the second proxy server and the data providing end, and has a second receiving end connected to the second proxy server, a second transmitting end, and a data connecting end connected to the data providing end. A second server end, the second receiving end receiving the first encoded data output by the second proxy server, decoding the first encoded data, and outputting the second server end to the data providing end, The data provider is used to output the provided data according to the demand data, the second server receives the provided data output by the data provider, and encodes the provided data into a third coded data, and the third coded The data is output by the second transmitting end.

The third proxy server is connected to the second transmitting end, receives the third encoded data output by the second transmitting end, and encodes the third encoded data into a fourth encoded data.

The second unidirectional gateway has a second input terminal connected to the third proxy server and a second output terminal, and the second input terminal receives the fourth encoded data output by the third proxy server. And is output by the second output terminal.

The fourth proxy server is disposed between the first receiving end and the second output end, receives the fourth encoded data output from the second output end, and decodes and restores the fourth encoded data to the third The encoded data is output to the first receiving end.

Thereby, the first server and the second server transmit two-way entities with an isolated structure. The first receiving end receives the third encoded data output by the fourth proxy server, and sends the first The three coded data are decoded and output from the first server to the data demand.

In the physically-isolated network transmission system of the present invention, the cables connecting all the devices between the first server and the second server are optical fiber cables or RJ45.

In the physically isolated network transmission system of the present invention, an enterprise bus is further provided to connect the second server end and the data providing end.

In the physically isolated network transmission system of the present invention, the first unidirectional gateway and the second unidirectional gateway are physical isolation devices.

In the entity-isolated network transmission system of the present invention, a one-way entity transmission isolation architecture includes: the first proxy server, the first unidirectional gateway, and the second proxy server. The first unidirectional gateway and the second proxy server cannot access the data of the first proxy server through the network. Another one-way entity transmission isolation architecture includes: the third proxy server, the second one-way gateway, and the fourth proxy server. Through the second one-way gateway, the fourth The proxy server cannot access the data of the third proxy server through the network.

In the physically-isolated network transmission system of the present invention, the first server and the second server have a function of being able to packet-encode and decode each other.

In summary, the physically-isolated network transmission system provided by the embodiment of the present invention uses a hardware device to implement the network transmission function, which can facilitate the user's access to data, and at the same time can prevent hackers from invading. Threats greatly reduce the risk of confidential information being invaded and leaked.

The foregoing and other technical contents, features, and effects of the present invention will be clearly presented in the following detailed description of the preferred embodiments with reference to the drawings.

Please refer to FIG. 2. The physically isolated network transmission system 2 of the present invention is suitable for being disposed between a data demand terminal 3 and a data providing terminal 4. The data demand terminal 3 is used to output a demand data. The data provides The terminal 4 is used to output a provided data according to the demand data.

Please refer to FIG. 3. The above-mentioned physical network-isolated transmission system 4 includes a first server 20, a first proxy server 30, a first unidirectional gateway 40, a second proxy server 50, and a first server. Two servers 60, a third proxy server 70, a second one-way gateway 80, and a fourth proxy server 90. In addition, the data requester 3 and the first server 20, and the second server 60 and the data provider 4 may be TCP / IP (Transmission Control Protocol / Internet Protocol) or UDP (User Datagram). Protocol) or SOAP protocol or (Simple Object Access Protocol), but not limited to this.

The first server 20 has a first server end 21, a first transmitting end 22, and a first receiving end 23 connected to the data demand end 3. The first server end 21 can receive the data demand end The demand data output by 3 encodes the demand data into a first coded data, and the first coded data is output 22 by the first transmitting end.

The first proxy server 30 is connected to the first transmitting end 22 of the first server 20, receives the first encoded data output by the first transmitting end 22, and encodes the first encoded data into a second encoding. data.

The first unidirectional gateway 40 is a physical isolation device, and has a first input terminal 41 and a first output terminal 42 connected to the first proxy server 30. The first input terminal 41 receives the first proxy. The server 30 outputs the second encoded data, and outputs the second encoded data 42 from the first output terminal.

The second proxy server 50 is connected to the first output terminal 42 of the first unidirectional gateway 40, receives the second encoded data output from the first output terminal 42, and decodes and restores the second encoded data. Into the first coded data.

The second server 60 is disposed between the second proxy server 50 and the data providing terminal 4, and has a second receiving end 61, a second transmitting end 62, and a second transmitting end 62 connected to the second proxy server 50, and A second server end 63 connected to the data providing end 4, the second receiving end 61 receives the first encoded data output by the second proxy server 50, and decodes the first encoded data, and the first The second server terminal 63 outputs to the data providing terminal 4, the data providing terminal 4 is configured to output the provided data according to the required data, the second server terminal 63 receives the provided data output from the data providing terminal 4, and The provided data is encoded into a third encoded data, and the third encoded data is output by the second transmitting end 62.

As shown in FIG. 4, in this embodiment, an enterprise bus 5 is further connected between the second server end 60 and the data providing end 4, but it is not limited thereto, and the second server 60 and The data provider 4 is directly connected. The enterprise bus 5 provides functions such as reliable message transmission, service access, protocol conversion, data format conversion, and content-based routing, which shields the physical location, protocol, and data format of the service.

The third proxy server 70 is connected to the second transmitting end 62, receives the third encoded data output from the second transmitting end 62, and encodes the third encoded data into a fourth encoded data.

The second one-way gateway 80 is a physical isolation device, and has a second input terminal 81 and a second output terminal 82 connected to the third proxy server 70. The second input terminal 81 receives the third proxy. The fourth coded data output by the server 70 is output by the second output terminal 82.

The fourth proxy server 90 is disposed between the first receiving end 23 and the second output end 82, receives the fourth encoded data output from the second output end 82, and decodes and restores the fourth encoded data. The third encoded data is output to the first receiving end 23.

Thereby, the first receiving end 23 receives the third encoded data output by the fourth proxy server 90, and decodes the third encoded data, and the first server end 21 outputs the data to the data demand end. 3.

In this embodiment, the cable connecting all the devices between the first server 20 and the second server 60 is an optical fiber cable, but it is not limited to this, and it can also be RJ45. In addition, the first server 20 and the second server 60 are isolated from each other by two unidirectional entities. One of the unidirectional physical transmission isolation architectures includes the first proxy server 30, the first unidirectional gateway 40, and the second proxy server 50 through the first unidirectional gateway 40, The second proxy server 50 cannot access the data of the first proxy server 30 through the network. Another one-way entity transmission isolation architecture includes: the third proxy server 70, the second one-way gateway 80, and the fourth proxy server 90 through the second one-way gateway 80, The fourth proxy server 30 cannot access the data of the third proxy server 70 through the network. Allowing data to be transmitted in these two unidirectional physical transmission isolation structures not only meets the security principles, but also maintains the convenience of transmission. Therefore, the outside world cannot invade the secrets through the Internet, and the data cannot be leaked out, and users can access the data conveniently, while preventing the risk of confidential documents being invaded.

It is worth mentioning that the first server 20 and the second server 60 have the function of packet encoding and decoding with each other. In this embodiment, the first server 20 receives the demand data of the data demand end 3, and The software packet code in the first server is decoded by the second server 60 to achieve the purpose of protecting the transmitted data. In addition, the second server 60 can also encode the provided data packet and decode it through the first server 20 to achieve the above-mentioned effect.

Based on the above, the structure and configuration description of each component of a physically isolated network transmission system provided by the present invention.

The invention has the following effects:

First, data can be exchanged with each other without reducing security protection. Physical network isolation allows data to be transmitted only in one direction through the physical structure of the hardware. There is no possibility of reverse transmission. It may be close to 100% secure, but this approach is not practical. Because of the isolation of the physical network, there is still a need for data processing and data exchange. If a portable storage device is used to exchange data back and forth between the data demand side 3 and the data provider side 4, not only is it a waste of time and manpower , Which leads to problems in tracking and auditing, and has financial concerns. Therefore, the present invention improves the above-mentioned shortcomings by means of establishing a two-way physical transmission isolation architecture between the first server 20 and the second server 60 to form a two-way physical isolation network transmission system 2, The first server 20 receives a file and packages the file, generates another packaged file, such as an xml file, etc., outputs the packaged file to the first proxy server 30, and then the first server 30 The unidirectional box server 40 receives the packaged file and transmits it to the second proxy server 50. The processes of the transmission operation are all at the physical layer of the network. The invention has the advantages of the original physical network isolation security, and can use the portable storage device quickly and without manpower, and can automatically exchange data between the data demand end 3 and the data supply end 4 .

Second, prevent network viruses from invading. Through the first unidirectional gateway 40 and the second unidirectional gateway 80 between the first server 20 and the second server 60, only one-way transmission characteristics can be achieved to meet the data requirements. The effect of physical isolation between the terminal 3 and the data provider 4; it can prevent hackers or users from directly accessing the data or confidential documents of the data provider 4 through the network, thereby isolating network threats. Programs, network attacks, invasion and destruction of network viruses cannot modify or write to the entity's isolated network transmission system 2 so that the entity's isolated network transmission system 2 can completely isolate external threats. Can achieve the purpose of transmitting data.

Third, it can be transmitted by optical fiber lines. In addition to being free of interference from noise and electromagnetic waves, the optical fiber line has a large communication bandwidth, which can reach more than 1 ~ 2GHz. Compared with ordinary ordinary coaxial cables, the optical fiber has a very high carrying capacity. In addition, it has high confidentiality, and the optical signal will not be radiated from the optical fiber, which is suitable for computer network or bank connection.

<Learning>

1‧‧‧ Traditional Information Security Defense Architecture

10‧‧‧Firewall

<this invention>

2‧‧‧ Physically Isolated Network Transmission System

3‧‧‧ Data Demand Side

4‧‧‧ data provider

5‧‧‧Business Bus

20‧‧‧First server

21‧‧‧First server

22‧‧‧ the first transmitting end

23‧‧‧ the first receiving end

30‧‧‧First proxy server

40‧‧‧The first one-way gateway

41‧‧‧first input

42‧‧‧first output

50‧‧‧Second proxy server

60‧‧‧Second server

61‧‧‧Second receiver

62‧‧‧Second transmitting end

63‧‧‧Second server

70‧‧‧Third proxy server

80‧‧‧Second one-way gateway

81‧‧‧second input

82‧‧‧Second output

90‧‧‧Fourth proxy server

FIG. 1 is a general traditional information security defense system, illustrating a structure diagram in which a general traditional information security defense system firewall is disposed between a data demand end and a data providing end;

FIG. 2 is a structural diagram of an isolated network transmission system according to an embodiment, illustrating a state in which an isolated network transmission system is disposed between a data demand end and a data supply end;

FIG. 3 is a structural diagram of the embodiment of FIG. 2, illustrating an internal structure of a physically isolated network transmission system; and

FIG. 4 is a structural diagram of an embodiment of FIG. 3 connected to an enterprise bus, illustrating that the enterprise bus is disposed between a second server and a data providing terminal.

Claims (5)

A physically isolated network transmission system is suitable for being located between a data demand end and a data supply end, the data demand end is used to output a demand data, and the data supply end is used to output a provision according to the demand data Data, the physical network isolated transmission system includes: a first server having a first server end connected to the data demand end, a first transmitting end, and a first receiving end, the first server The terminal can receive the demand data output by the data demand side and encode the demand data into a first coded data, and the first coded data is output by the first transmitting end; a first proxy server connected to the first server The first transmitting end of the receiver, receiving the first encoded data output by the first transmitting end, and encoding the first encoded data into a second encoded data; a first unidirectional gateway having a connection to the first A first input end of a proxy server and a first output end, the first input end receives the second encoded data output by the first proxy server, and passes the second encoded data from the first Outgoing output; a second proxy server connected to the first output of the first unidirectional gateway, receiving the second encoded data output from the first output, and decoding and restoring the second encoded data Into the first coded data; a second server is provided between the second proxy server and the data providing end, and has a second receiving end, a second transmitting end, And a second server end connected to the data providing end, the second receiving end receives the first encoded data output by the second proxy server, decodes the first encoded data, and the second server end Output to the data provider, the data provider is used to output the provided data according to the demand data, the second server receives the provided data output by the data provider, and encodes the provided data into a third code Data, and the third encoded data is output by the second transmitting end; A third proxy server connected to the second transmitting end, receiving the third encoded data output by the second transmitting end, and encoding the third encoded data into a fourth encoded data; a second one-way gateway Having a second input terminal connected to the third proxy server and a second output terminal, the second input terminal receives the fourth encoded data output by the third proxy server, and the second output terminal Output; and a fourth proxy server, disposed between the first receiving end and the second output end, receiving the fourth encoded data output from the second output end, and decoding and restoring the fourth encoded data into The third encoded data is output to the first receiving end; thereby, the first server and the second server transmit an isolated architecture for two unidirectional entities, and one of the unidirectional entities transmits an isolated architecture. Including: the first proxy server, the first unidirectional gateway, and the second proxy server, through which the second proxy server cannot be accessed through the network Data of the first proxy server, and The one-way entity transmission isolation architecture includes the third proxy server, the second one-way gateway, and the fourth proxy server. Through the second one-way gateway, the fourth agent The server cannot access the data of the third proxy server through the network. The transmission and operation processes are all in the physical layer of the network. The first receiving end receives the third encoded data output by the fourth proxy server. And decode the third coded data from the first server to the data requester. The physically isolated network transmission system according to claim 1, wherein the cables connecting all the devices between the first server and the second server are optical fiber cables or RJ45. The physically isolated network transmission system according to claim 1, further comprising an enterprise bus connected between the second server end and the data providing end. The physically isolated network transmission system according to claim 1, wherein the first unidirectional gateway and the second unidirectional gateway are physical isolation devices. The physically isolated network transmission system according to claim 1, wherein the first server and the second server have a function of being able to encode and decode packets with each other.