CN1305271C - Network safety isolating and information exchanging system and method based on proxy mapping - Google Patents

Abstract

A system and method for network security isolation and information exchange based on proxy mapping. It is used in the fields of information security and network data exchange. The internal and external network processing units of the system of the present invention are respectively connected to the internal network and the external network. The isolated switching unit includes an isolated switching controller and an isolated memory. The internal and external network processing units are connected to the isolated switching controller through a high-speed data transmission line, and the isolated switching control The device is also connected to the isolated storage, the internal and external network processing units can only have one access isolation storage, the internal and external network processing units exchange information through the isolated switching unit, the internal network processing unit contains a proxy stub, and the external network processing unit contains a proxy engine. The method of the present invention calls the internally defined transmission interface through the proxy stub and the proxy engine and completes the data exchange between the internal and external network processing units by isolating the switching unit, thereby establishing a link between the internal network client and the external network server in the form of proxy mapping. information exchange channels between them.

Description

System and method for network security isolation and information exchange based on proxy mapping

technical field

The invention relates to a system and method for network security isolation and information exchange, in particular to a system and method for network security isolation and information exchange based on proxy mapping. It is used in the fields of information security and network data exchange.

Background technique

The currently widely used network border security protection mechanism is implemented through firewalls. The implementation technologies of firewall include mainly packet filtering, application proxy and state inspection. Since the hardware architecture of the firewall adopts a single bastion host, once it is captured by hackers, the firewall will completely lose its effectiveness. Therefore, ordinary network firewall products can no longer meet the security requirements of important networks and data. For users with high-level requirements for network security, such as finance, government and scientific research institutions, they often establish a dedicated internal network, and use physical isolation between the internal network and the external network. This brings inconvenience to information exchange between different trust domains. Security isolation and information exchange is a new type of technology that can perform moderately secure information exchange on the basis of ensuring link isolation between internal and external networks. The feature of this technology is that in the security isolation and information exchange system, the link connecting the internal and external networks is disconnected, and the data is exchanged by means of ferry through the high-isolation memory. The data exchanged between the networks are all application layer data, and the system does not directly Or indirectly forward data in the form of IP packets. Because the way of exchanging data with hardware isolation interrupts the direct protocol interaction between the internal and external networks, it can provide higher security than the firewall in principle.

At present, the security isolation and information exchange system generally adopts the method of double-agent relay for information exchange. After searching, it is found that Beijing Jingtai Network Technology Co., Ltd. is a company specializing in the research and development and production of information security isolation products. The company's product in 2003 Jingtai Security Information Exchange System adopts the double-agent relay method. For example, for the mail business, a mail proxy server is installed in the intranet and the extranet respectively, and the mails sent by the intranet users are completely received by the intranet proxy server, and then switched to the extranet proxy server through Jingtai security information exchange system, and the extranet proxy The server then sends to the external network and vice versa. The disadvantage of this method is that the user needs to go through two complete caches and forwards to receive or send data, which is equivalent to two proxy servers on the internal and external networks mirroring and synchronizing data with the information exchange system through a security gap, and the real-time performance and scalability are poor. In addition, in addition to the security isolation and information exchange system, users are required to additionally configure internal and external network servers, which increases user costs and management complexity.

Contents of the invention

The purpose of the present invention is to address the shortcomings of the network security isolation and information exchange method based on double-agent relay, and propose a network security isolation and information exchange system and method based on agent mapping, that is, within the security isolation and information exchange system. Internet application layer data is mapped and exchanged by proxy. This method can provide proxy services for interactive network services based on Transmission Control Protocol (TCP), so that security isolation and information exchange equipment can support both non-real-time inter-network data exchange and support World Wide Web (WEB) browsing, e-mail (Email) transmission and other real-time network services. It improves the real-time performance of information interaction, and does not require users to configure additional servers outside the security isolation and information exchange system, reducing user costs and management complexity.

The present invention is realized through the following technical solutions. The safety isolation and information exchange system of the present invention includes three parts: an internal network processing unit, an external network processing unit and an isolation exchange unit. The internal and external network processing units each have a network interface and an independent IP address, which are respectively connected to the trusted domain network (intranet) and the non-trusted domain network (external network). They are two independent server systems, and the isolated switching unit includes The isolation switching controller and the isolation storage, the internal and external network processing units are respectively connected to the isolation switching controller of the isolation switching unit through high-speed data transmission lines, and the isolation switching controller is also connected to the isolation storage. At any point in time, the internal and external The network processing unit can only have one access isolation memory. The internal and external network processing units exchange information through the isolated switching unit. The internal network processing unit contains a proxy stub, and the external network processing unit contains a proxy engine. For internal network users, security isolation and The information exchange system is an application proxy server. The proxy stub and the proxy engine work together to complete a complete application proxy server function. The two communicate and exchange data through the application transmission protocol based on the isolated switching unit.

The function of the isolation switching control unit is equivalent to a single-pole double-throw electronic switch, which periodically switches between the internal and external network processing units and the high-speed data transmission lines connected to it, ensuring that at any point in time, the internal and external network processing Units can only have one access to high-isolation memory.

The security high-isolation and information exchange system works in the proxy server mode. Intranet users can view the system as a common application proxy server. When using the World Wide Web and e-mail services, the user needs to set a proxy in the corresponding client software (IE or OUTLOOK), and the address of the proxy server is the address of the system intranet processing unit. A complete proxy server function is divided into two parts: the proxy engine located in the external network processing unit and the proxy stub located in the internal network processing unit. The proxy stub and the proxy engine communicate by calling the transmission interface in the internal and external networks. The transmission interface transmits the information to the switching control software, and through it drives the isolated switching unit to complete the switching between the internal and external processing units of information:

The proxy stub is a system daemon process for each network service on the intranet processing unit of the security isolation and information exchange system. It communicates with the TCP/IP protocol stack through SOCKET call at the network interface end, and communicates with the internal mapping protocol through the transmission interface at the high-isolation exchange end. The proxy stub mainly implements the front-end processing of a proxy server, including:

Checks for connection requests from users in trusted domains. After recording the status of each legal connection, the connection request will be forwarded to the proxy engine of the external network processing unit through the internal mapping protocol.

Process the data received by the mapping protocol from the external network processing unit, and forward the data to the corresponding connection in the internal network according to the saved connection status.

The proxy engine, in the external network processing unit, communicates with the TCP/IP protocol stack through network socket (SOCKET) calls at the network interface end, and communicates with the internal mapping protocol through the transmission interface at the isolation exchange end. For each type of network traffic, it is a system daemon that implements most of the processing of a complete proxy server, including:

Receive service requests from the intranet processing unit through the transmission interface, and send application requests to the external network server.

Receive the data returned by the external network server, and perform content inspection and virus inspection on the data.

Call the transmission interface to switch the information returned from the external network back to the internal network through the isolated transmission channel.

The transmission interface is an interface for communication between the proxy engine and the proxy stub and the internal mapping protocol, and mainly performs the following processing:

Receive the information to be exchanged from the proxy stub or proxy engine, encode and encapsulate it into an internal mapping protocol message, and then write it into the isolated memory through the switching control program.

Read the data exchanged by the internal and external network processing units from the switching control program, and after analyzing the message according to the internal mapping protocol, distribute the message information to different proxy stubs or proxy engines.

The switching control software realizes the identification and control of the hardware of the high-isolation switching unit, ensures that the physical device is actually connected when reading and writing data at the transmission protocol layer, and ensures the reliability of reading and writing. It is the hardware driver of the isolated switching unit in the system and provides a communication interface with the internal mapping protocol process.

In the network security isolation and information exchange method based on agent mapping in the present invention, the above-mentioned security isolation and information exchange system serves as a network proxy server to provide network proxy services to intranet users, and is respectively located inside and outside the security isolation and information exchange system. The proxy stub and proxy engine of the network processing unit call the internally defined transmission interface and complete the data exchange between the internal and external network processing units by isolating the switching unit, thereby establishing a link between the internal network client and the external network server in the form of proxy mapping. information exchange channels between them.

The method of the present invention is further limited below, the intranet user completes the method for network information exchange through security isolation and information exchange system, and its steps are as follows:

(1) The intranet processing unit provides network proxy services to intranet users through proxy stubs, and uses TCP/IP protocol to communicate with intranet users. It opens a public TCP port for each network service provided at the network connection end, and continuously listens to the network requests of intranet users on this port.

(2) After receiving a network application request from an intranet user, the proxy stub performs corresponding identity authentication on the user connection according to different application protocols, and performs security checks and filters on the protocol data. If the check fails, the intranet user will be notified and the connection will be disconnected.

(3) The application request accepted by the proxy stub internally reserves the connection information for it. After the connection request is encapsulated according to the internal mapping protocol, the proxy stub calls the transmission interface and writes the data into the isolation switching unit.

(4) The proxy engine of the external network processing unit has been detecting whether there is data written by the proxy stub in the isolated switching unit by calling the transmission interface. If there is no new data, the processing process is blocked, otherwise the data sent by the proxy stub is read. .

(5) After the proxy engine receives the information from the intranet processing unit, it analyzes it according to the internal mapping protocol. If it is a new network application request, it retains the connection information and returns the proxy stub confirmation information to establish a piece of data passing through the isolation switching unit. transmission channel.

(6) The proxy engine provides a complete proxy service according to the received network application request, that is, the network end of the external network processing unit sends a connection request to the external server using the TCP/IP protocol and obtains data. This process is based on different network applications according to the standard internet communication protocol.

(7) After the data received by the proxy engine is checked for security, such as content filtering and virus killing, the transmission interface is called to encapsulate the data according to the internal mapping protocol, and then write it into the isolation exchange unit.

(8) The proxy stub in the internal network processing unit is on the side of the isolated switching unit, and operates as the proxy engine in step (4), to receive the data transmitted from the external network processing unit.

(9) The data transmitted by the external network processing unit received by the proxy stub is analyzed with the mapping protocol, if it is the data transmission channel confirmation information returned by the proxy engine in step (5), then the data transmission channel is established and its information is retained.

(10) What the proxy stub receives is the application data, then use the data transmission channel information retained in the step (9) to retrieve the intranet user connection information retained in the step (3), and send the data to the user with the TCP/IP protocol according to the information Intranet users.

(11) After the proxy stub completes the user request or the proxy engine completes the data transmission, it can call the transmission interface to write the data transmission channel release request, delete and release the network application requests reserved in steps (3), (5) and (9) Connection information and data transmission channel information and its resources.

(12) The proxy stub or the proxy engine receives the data transmission channel release request sent by the other party, deletes and releases the connection information and data transmission channel information and the information requested by the network application retained in steps (3), (5) and (9) resource, ends a web application data transfer.

The safety isolation and information exchange system of the present invention adopts the dual-host isolation exchange mode of the internal and external network processing unit plus the isolation exchange unit, disconnects the direct link connection between the internal and external networks, and interrupts the interactive network protocol between the internal and external networks , using the proxy mapping method for pure data isolation and exchange, can resist all network attacks based on interactive protocols. In the safety isolation and information exchange method of the present invention, the network application request is completely initiated by the internal network user, and the external network user cannot actively send any data to the internal network, which strictly protects the security of the internal network. In addition, intranet users can request external network services in real time, while external network application data only needs to be cached and checked for security once in the external network processing unit, thereby avoiding the disadvantages of the dual-agent relay mode.

Description of drawings

Fig. 1 Structural schematic diagram of safety isolation and information exchange system of the present invention

Figure 2 System protocol stack structure diagram

Figure 3 Diagram of the dialogue process of the application transport protocol

Figure 4 Proxy engine structure diagram supporting mail and WEB services

Figure 5 Proxy stub structure diagram supporting mail and WEB services

Detailed ways:

The technical solution of the present invention will be further described below in conjunction with the accompanying drawings. Figure 1 is a block diagram of the security isolation and information exchange system. In the prototype system, the internal and external network processing units choose the X86-based industrial control system, and the high-speed data transmission line can use SCSI or USB buses. According to the different buses, different isolation switching control units can be realized, and the corresponding isolation memory can be selected, such as SCSI or USB interface hard disk.

The operating system of the internal and external network processing units selects the Linux operating system, and the protocol stack in the system is shown in Figure 2. The proxy engine communicates with the intranet processing unit through the isolation switching unit, and performs virus filtering and security inspection on the data. The internal network processing unit uses the proxy stub to perform proxy services for various businesses (such as EMAIL and WEB), and communicates with the external network processing unit through the isolated switching unit. The proxy stub also realizes access control, data security check and virus protection. filtering etc.

The proxy engine and the proxy stub transmit application layer data through an isolated exchange unit, and use a custom application transport protocol to maintain the dialogue process. The basic protocol dialogue process is shown in Figure 3. The proxy stub retains the relevant information after receiving the intranet request. Information and request to the proxy engine to establish a connection, the proxy engine replies with the connection establishment confirmation and retains the relevant information of the connection, so that a data mapping channel is established between the internal and external network processing units, and the information obtained by the proxy engine from the external network can pass through this channel for transmission. The information received by the proxy stub can be sent to the corresponding intranet host according to the previously reserved intranet request information. When the information exchange is over, both the proxy engine and the proxy stub can propose to disconnect and release related resources.

Taking support for mail service and World Wide Web service as an example, Figure 4 is a structural diagram of the proxy engine implemented in the external network processing unit of the prototype system. In order to reduce the difficulty of implementation, the agent engine adopts the general mail agent QMAIL software and the World Wide Web agent SQUID software with enhanced security inspection functions, and the agent engine uses these general agent service programs to complete the specific network agent service work. The connection management module is only responsible for data forwarding, that is, it sends and receives data from the transmission interface, and communicates with the general network agent service program (such as QMAIL) through the local network socket SOCKET to complete the forwarding function. The connection management module opens a separate thread at the transmission interface to read the data from the isolation switching unit. It creates a new working thread for processing each time it receives a mapped connection request, and provides services through the local network socket SOCKET and the general proxy. The program establishes a connection through which data is sent and received. Fig. 5 is a structural diagram of the proxy stub implemented by the intranet processing unit in the prototype system. The general sub-module is the basic module for data forwarding. Its main functions are: sending and receiving data from both ends, managing each working thread, unpacking and distributing data on the transmission interface, etc. Both the mail processing sub-module and the World Wide Web processing sub-module are extension modules of the general sub-module, and are used for analyzing and processing specific protocols. The proxy stub module is implemented in C++ multi-threaded mode, so the thread is controlled by the object, that is, each object corresponds to a single or multiple worker threads to perform its tasks, and the object controls the creation, execution, and stop of all threads under it. Management work, communication between threads is done by means of unnamed pipes. The proxy stub sends and receives data from the SOCKET and the transmission interface at the same time, and performs bidirectional forwarding after data processing. On the SOCKET side, the proxy stub opens the service port to monitor according to the configuration requirements. For example, it listens to the WEB request initiated by the intranet user on port 80, and creates a worker thread for processing every time a connection request is received; on the transmission interface side, the STUB module independently Open a thread to read the data of the transmission interface, and forward the data to the corresponding worker thread. The worker thread processes and checks the received data, and then forwards it.

The system and method avoid the disadvantages of double-agent relay high isolation and poor real-time information exchange method, complicated management and extra server resources, and can provide support for various network services. The safety isolation and information exchange system designed and realized according to the present invention can support safe e-mail, safe WEB browsing, safe database exchange and safe file exchange under the condition of safety isolation between internal and external networks. At present, the system has passed the inspection and certification of the National Information Security Evaluation and Certification Center and obtained the information security product sales license of the Ministry of Public Security, and has been promoted and used in many units with good results.

Claims (8)

1, a kind of network security based on agency's mapping is isolated and Information Exchange System, comprise: the Intranet processing unit, outer net processing unit and isolation crosspoint, it is characterized in that, in, the outer net processing unit has a network interface and independent IP address separately, connecting Intranet and outer net respectively, they are two independently server systems, isolate crosspoint and comprise isolation switch controller and sequestering memory, in, the outer net processing unit links to each other with the isolation switch controller of isolating crosspoint by high speed data transmission line respectively, isolate switch controller and also connecting sequestering memory, at any time, in, the outer net processing unit can only have a visit sequestering memory, the intranet and extranet processing unit is by isolating the crosspoint exchange message, the Intranet processing unit comprises one and acts on behalf of counterfoil, the outer net processing unit comprises an agent engine, acts on behalf of counterfoil and agent engine association and engages in the dialogue and exchanges data by the application transport agreement based on isolating crosspoint.

2, the network security based on agency's mapping according to claim 1 is isolated and Information Exchange System, it is characterized in that, for Intranet user, it is an Application Launcher, finish a complete Application Launcher function by acting on behalf of counterfoil and agent engine collaborative work, acting on behalf of counterfoil and agent engine communicates by the coffret that calls in the inside and outside net, coffret passes to switching controls software with information, and drives by it and to isolate the switching hardware unit and finish the switching of information between inside and outside processing unit.

3, the network security based on agency's mapping according to claim 1 and 2 is isolated and Information Exchange System, it is characterized in that, the described counterfoil of acting on behalf of, on the Intranet processing unit, it is system's finger daemon to each Network, and it calls with the ICP/IP protocol stack by SOCKET at the network interface end and communicates by letter, isolate exchange end by coffret with inner shadowing agreement communication, act on behalf of counterfoil and realize the front-end processing of an acting server, comprising:

To checking from trust domain user's connection request, behind the state of each legal connection of record, connection request will be transmitted to the agent engine of outer net processing unit by inner shadowing agreement;

Handle the data that shadowing agreement receives from the outer net processing unit, and connect for Intranet accordingly data forwarding according to the connection status of preserving.

4, the network security based on agency's mapping according to claim 1 and 2 is isolated and Information Exchange System, it is characterized in that, described agent engine, in the outer net processing unit, it calls with the ICP/IP protocol stack by SOCKET at the network interface end and communicates by letter, and communicates by letter with inner shadowing agreement by coffret at the isolation exchange end, to each Network, it is system's finger daemon, realizes that the overwhelming majority of a complete acting server handles, and comprising:

By the service request of coffret reception, send application request to external network server from the Intranet processing unit;

Receive the data that external network server is returned, data are carried out Content inspection and checking and killing virus;

Call coffret, the information that external network returns is switched back Intranet by isolated transmission channel.

5, the network security based on agency mapping according to claim 2 is isolated and Information Exchange System, it is characterized in that, described coffret is an agent engine and act on behalf of the interface of communicating by letter between counterfoil and the inner shadowing agreement, mainly carries out following processing:

Reception is from the information of the needs exchange of acting on behalf of counterfoil or agent engine, is written in the sequestering memory by switching control program with its coding, after being packaged into inner shadowing agreement message;

From switching control program, read in the data of intranet and extranet processing unit exchange, behind inner shadowing agreement analytic message, message information is distributed to acts on behalf of counterfoil or agent engine.

6, the network security based on agency's mapping according to claim 2 is isolated and Information Exchange System, it is characterized in that, described switching controls software, realization is to isolating the identification and the control of crosspoint hardware, guarantee when transmission protocol layer reads and writes data it is the true connection of physical equipment, and guarantee the reliability of read-write, it for isolating the hardware drive program of crosspoint, and provides communication interface with inner shadowing agreement process in system.

7, a kind of network security based on agency's mapping is isolated and information switching method, it is characterized in that, provide network agent service as a network agent server to Intranet user with Information Exchange System by the safety isolation, by laying respectively in safety isolation and the Information Exchange System, the outer net processing unit act on behalf of that counterfoil and agent engine are called the coffret of inner definition and by isolating in crosspoint finishes, exchanges data between the outer net processing unit, thus information exchange path between an Intranet client and the outer network server set up in the mode of agency mapping.

8, the network security based on agency's mapping according to claim 7 is isolated and information switching method, it is characterized in that, below the inventive method is further limited, Intranet user is isolated the method for finishing network information exchange with Information Exchange System by safety, its step is as follows:

(1) the Intranet processing unit provides the network agent service by acting on behalf of counterfoil to Intranet user, adopt TCP/IP to communicate by letter with Intranet user, it for the open public tcp port of each Network that provides, intercepts the network requests of Intranet user at the network link on this port;

(2) after receiving the network application request that an Intranet user sends, act on behalf of counterfoil and carry out corresponding authentication according to application protocol the user is connected, and protocol data carried out safety inspection and filtration, as then notifying Intranet user and disconnect and connecting by checking;

(3) act on behalf of the application request that counterfoil accepts and be its reservation link information in inside, connection request according to inner shadowing agreement packed after, act on behalf of counterfoil and call coffret, data are write the isolation crosspoint;

(4) agent engine acting on behalf of the data that counterfoil writes by calling whether having in the coffret detection isolation crosspoint, if new data is arranged, then reads and act on behalf of the data that counterfoil transmits, otherwise treatment progress gets clogged always;

(5) agent engine is resolved according to inner shadowing agreement after receiving the information that the Intranet processing unit transmits, if new network application request then keeps link information, and return and act on behalf of the counterfoil confirmation and set up one by isolating the data transmission channel of crosspoint;

(6) agent engine provides complete agency service according to the network application request of receiving, promptly send connection request and obtain data with ICP/IP protocol to external server from outer net network of processing units end, this process is carried out according to the Internet communication protocol of standard according to network application;

(7) data received of agent engine are after safety inspection, call coffret data are write the isolation crosspoint after by inner shadowing agreement encapsulation;

(8) act on behalf of counterfoil and isolating crosspoint one side,, receive data from the transmission of outer net processing unit as agent engine operation in the step (4);

(9) data of acting on behalf of the outer net processing unit transmission that counterfoil receives are resolved with shadowing agreement, if the data transmission channel confirmation that agent engine is returned in the step (5) is then set up data transmission channel and kept its information;

What (10) act on behalf of that counterfoil receives is that application data is then used the Intranet user link information that keeps in the data transmission channel information retrieval step (3) that keeps in the step (9), according to this information data is sent to Intranet user with ICP/IP protocol;

(11) acting on behalf of counterfoil finishes user request or agent engine and finishes and can both call coffret after the transfer of data and write data transmission channel and discharge request, link information and the data transmission channel information and the resource thereof of network application request of reservation in deletion and release steps (3), (5) and (9);

(12) act on behalf of the data transmission channel release request that counterfoil or agent engine receive that the other side sends, link information and the data transmission channel information and the resource thereof of the network application request that keeps in deletion and release steps (3), (5) and (9) finish the transmission of primary network application data.

Images