CN114154609A - One-way safe transmission simple device of private protocol - Google Patents

One-way safe transmission simple device of private protocol Download PDF

Info

Publication number
CN114154609A
CN114154609A CN202111573981.5A CN202111573981A CN114154609A CN 114154609 A CN114154609 A CN 114154609A CN 202111573981 A CN202111573981 A CN 202111573981A CN 114154609 A CN114154609 A CN 114154609A
Authority
CN
China
Prior art keywords
data
detection
private
protocol
stream
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202111573981.5A
Other languages
Chinese (zh)
Inventor
袁伟
杨晖
田功平
蓝俊
郑敏
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fujian Meteorological Information Center Fujian Meteorological Archives
Original Assignee
Fujian Meteorological Information Center Fujian Meteorological Archives
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fujian Meteorological Information Center Fujian Meteorological Archives filed Critical Fujian Meteorological Information Center Fujian Meteorological Archives
Priority to CN202111573981.5A priority Critical patent/CN114154609A/en
Publication of CN114154609A publication Critical patent/CN114154609A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06KGRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
    • G06K19/00Record carriers for use with machines and with at least a part designed to carry digital markings
    • G06K19/06Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
    • G06K19/067Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
    • G06K19/07Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
    • G06K19/077Constructional details, e.g. mounting of circuits in the carrier
    • G06K19/0772Physical layout of the record carrier
    • G06K19/07732Physical layout of the record carrier the record carrier having a housing or construction similar to well-known portable memory devices, such as SD cards, USB or memory sticks
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38Information transfer, e.g. on bus
    • G06F13/40Bus structure
    • G06F13/4063Device-to-bus coupling
    • G06F13/4068Electrical coupling
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38Information transfer, e.g. on bus
    • G06F13/42Bus transfer protocol, e.g. handshake; Synchronisation
    • G06F13/4282Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/602Providing cryptographic facilities or services
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/64Protecting data integrity, e.g. using checksums, certificates or signatures
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/78Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer to assure secure storage of data
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F2213/00Indexing scheme relating to interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F2213/0042Universal serial bus [USB]

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • General Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • Health & Medical Sciences (AREA)
  • Microelectronics & Electronic Packaging (AREA)
  • Computer And Data Communications (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention discloses a one-way safe transmission simple and convenient device of a private protocol, which belongs to the field of data transmission and comprises a main packaging outer package, wherein a computer end interface is fixedly connected at the center of the right end of the main packaging outer package; the invention can reduce the cost, improve the throughput rate of the device, greatly improve the docking flexibility of the device, improve the safety and reliability, and facilitate the high-reliability data exchange between the equipment accessed to the Internet and the service safety intranet.

Description

One-way safe transmission simple device of private protocol
Technical Field
The invention relates to the field of data transmission, in particular to a one-way safe transmission simple and convenient device of a private protocol.
Background
As the business continues to grow, large amounts of data need to be exchanged between the internet and the weather-specific network. But at the same time, the network security must also be compromised. Although under the protection and driving of various safety devices, the dual requirements of the current data exchange requirement and the network safety can be effectively solved, at the same time, the problems are brought, firstly, the investment cost is high, the firewall, the network gate, the IPS, the flow analysis, the situation perception and the like are configured in a set, the number of the investment scenes is hundreds of thousands, the number of the investment scenes is millions, and the investment scenes of tens of millions are not few, the safety performance of the investment scenes depends on the soft and hard environment of the purchased devices, and the deployment and application are generally developed in a relatively fixed and stable service environment; secondly, the adaptability to the change of the demand is not flexible enough, and especially, cross-network data exchange and customized exchange under various network environments have higher requirements on parameter configuration, data docking, personnel technical ability and the like; thirdly, the temporary, transient and accidental data exchange between mobile office and private network and public network has frequent service appeal;
the existing one-way safe transmission simple and convenient device of the private protocol is not flexible enough in butt joint capability, high in manufacturing cost and low in safety, and therefore the one-way safe transmission simple and convenient device of the private protocol is provided.
Disclosure of Invention
The invention aims to solve the defects in the prior art, and provides a one-way safe transmission simple device of a private protocol.
In order to achieve the purpose, the invention adopts the following technical scheme:
a one-way safe simple and convenient transmission device of a private protocol comprises a main packaging outer package, wherein a computer end interface is fixedly connected to the center of the right end of the main packaging outer package, plastic shells are fixedly connected to two ends of the main packaging outer package respectively, a cable output port is formed in the center of the left end of the main packaging outer package, a circuit board is movably connected inside the main packaging outer package, a core circuit is fixedly connected inside the circuit board, an MCU is welded to the center of the upper end of the core circuit, a TYPE-C interface is welded to the right side of the upper end of the core circuit, and an SPI wiring port is welded to the left side of the upper end of the core circuit;
the MCU comprises a USB transmission interface, a safety detection module, a private transceiving protocol module and a data driving module;
the USB transmission interface is used for data transfer processing and power supply between the two groups of MCUs;
the safety detection module is used for overall safety protection of data and storage and scheduling of key parameters required by safety operation processing;
the private transceiving protocol module is used for carrying out private customization on an encapsulation protocol of a data stream and is solidified in the built-in chip in a read-only and encryption mode;
the data driving module specifically comprises a security check unit and a private transmission protocol unit;
the security inspection unit is used for performing security feature inspection on the data block, detecting the whole data file and searching and killing malicious codes, and simultaneously connecting a security module of the service private network part and performing security inspection according to the current configuration;
the private transmission protocol unit is used for splitting and combining the data, checking the integrity of the data and encrypting and decrypting the data in a self-organizing way.
As a further scheme of the invention, the safety detection comprises the following specific steps:
the method comprises the following steps: monitoring the collected data flow, and performing rapid processing and hardware resource scheduling on the data packet;
step two: filtering unnecessary data through a filter, carrying out secondary processing on the filtered data, and respectively carrying out feature detection, metadata or file extraction and flow storage processing;
step three: detecting known attacks based on characteristics through a characteristic detection engine, realizing detection data preprocessing through metadata or file extraction, and realizing data retention evidence obtaining through flow storage;
step four: and generalizing the metadata and the events through a middleware, submitting the processed data to each group of detection engines and correlation engines for centralized detection, and finally outputting the detection result in a log or alarm form.
As a further scheme of the invention, the detection engine specifically comprises an AI detection engine, an abnormal behavior detection engine, a file detection engine, a threat intelligence detection engine and a Yara/JA3/SSL detection engine.
As a further scheme of the invention, the specific steps of the splitting and combining are as follows:
step 1: classifying data into a group according to N bytes, wherein N is more than or equal to 1024 bytes, and parameters can be configured;
step 2: the data file information is put into the first group, the second group starts to import the data binary stream, and the last group receives the frame end identification or the data length/N residual part information.
As a further aspect of the present invention, the data file information specifically includes a file name, creation time, data size, and an overall check code.
As a further scheme of the present invention, the self-organizing encryption and decryption specifically comprises the following steps:
the first step is as follows: before the data frame enters encryption, a synchronous information stream is added, and a plaintext byte stream is formed through the synchronous information stream;
the second step is that: the plaintext byte stream and the key byte stream of the self-synchronizing sequence password are operated to be output as ciphertext, and the ciphertext participates in the next key production;
the third step: after the program receives the data, positioning and decrypting the starting point and the advanced parameter information through the synchronous information flow, generating a flow according to the same secret key, and performing XOR operation to obtain a plaintext byte stream.
Compared with the prior art, the invention has the beneficial effects that:
1. the invention is provided with a data driving module, after a data file is copied to the virtual drive letter through the USB transmission interface, after the file is detected by the driving, loading and packaging files, sending into data driving module, performing security feature inspection on data blocks, detecting data files integrally, and killing malicious codes, splitting and combining data via private transmission protocol unit arranged in the data driving module, meanwhile, the integrity of the data is verified, the data is self-organized and encrypted, the encryption is completed, the data is sent to the MCU at the other end, reverse operation is carried out, and a data file is restored to the data virtual disk at the opposite end, so that the cost can be reduced, the throughput rate of the device is improved, the docking flexibility of the device is greatly improved, the safety and reliability are improved, and high-reliability data exchange between equipment accessed to the Internet and a service safety intranet is facilitated flexibly.
Drawings
The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this specification, illustrate embodiments of the invention and together with the description serve to explain the principles of the invention and not to limit the invention.
FIG. 1 is a system block diagram of a one-way secure transport facility according to a proprietary protocol;
fig. 2 is a block diagram of a data driving module of a unidirectional secure transmission simple apparatus with a private protocol according to the present invention;
FIG. 3 is a top view of a one-way secure transport facility according to the proprietary protocol of the present invention;
FIG. 4 is a front view of a one-way secure transport facility for proprietary protocols in accordance with the present invention;
FIG. 5 is a right side view of a one-way secure transport facility for proprietary protocols in accordance with the present invention;
FIG. 6 is a left side view of a one-way secure transport facility for proprietary protocols in accordance with the present invention;
fig. 7 is a left side view of a one-way secure transport facility of a proprietary protocol according to the present invention.
In the figure: 1. main packaging and outer packaging; 2. a computer end interface; 3. plastic shells; 4. a cable outlet; 5. a TYPE-C interface; 6. MCU; 7. a circuit board; 8. an SPI wiring port; 9. a core circuit.
Detailed Description
Referring to fig. 1-7, a simple and convenient device of one-way safe transmission of private agreement, including main encapsulation extranal packing 1, 1 right-hand member center department fixedly connected with computer end interface 2 of main encapsulation extranal packing, 1 both ends of main encapsulation extranal packing are fixedly connected with respectively and mould shell 3, 1 left end center department of main encapsulation extranal packing has seted up cable delivery outlet 4, the inside swing joint of main encapsulation extranal packing 1 has circuit board 7, the inside fixedly connected with core circuit 9 of circuit board 7, core circuit 9 upper end center department welding has MCU, core circuit 9 upper end right side welding has TYPE-C interface 5, core circuit 9 upper end left side welding has SPI wiring interface 8.
The MCU comprises a USB transmission interface, a safety detection module, a private transceiving protocol module and a data driving module.
The safety detection module is used for the whole safety protection of data and the storage and scheduling of key parameters required by safety operation processing.
It should be further noted that, part of the security detection information is built in the chip, and includes information such as a core detection engine, an index table, and a password table, and considering that the amount of code of the program is relatively large, part of the inspection program will be implemented in the driver, so as to increase malicious code detection and risk prevention.
The private transceiving protocol module is used for carrying out private customization on an encapsulation protocol of a data stream, and is solidified in the built-in chip in a read-only and encryption mode.
It should be further noted that the private transceiving protocol module body is handled and stored by the MCU.
Referring to fig. 2, the data driving module specifically includes a security check unit and a private transmission protocol unit.
The safety inspection unit is used for carrying out safety characteristic inspection on the data block, carrying out overall detection on the data file and searching and killing malicious codes, and simultaneously connecting a safety module of the business private network part and carrying out safety inspection according to the current configuration.
Specifically, the security inspection unit monitors and collects data traffic, rapidly processes data packets and schedules hardware resources, filters unnecessary data through a filter, secondarily processes the filtered data, respectively performs feature detection, metadata or file extraction and traffic storage processing, detects known attacks based on features through a feature detection engine, pre-processes the detected data through metadata or file extraction, simultaneously achieves data retention and evidence obtaining through traffic storage, generalizes metadata and events through middleware, submits the processed data to each group of detection engines and associated engines for centralized detection, and finally outputs detection results in a log or alarm form.
It should be further noted that the detection engine specifically includes an AI detection engine, an abnormal behavior detection engine, a file detection engine, a threat intelligence detection engine, and a Yara/JA3/SSL detection engine.
The private transmission protocol unit is used for splitting and combining the data, checking the integrity of the data and encrypting and decrypting the data in a self-organizing way.
Specifically, the private transmission protocol unit classifies data into a group according to N bytes, wherein N is more than or equal to 1024 bytes and is configurable with parameters, after grouping is completed, data file information is put into the first group, the second group starts to import data binary stream, and the last group receives frame end identification or data length/N residual part information.
It should be further noted that the data file information specifically includes a file name, a creation time, a data size, and an overall check code.
Specifically, the private transmission protocol unit adds a synchronous information stream before a data frame is encrypted, and forms a plaintext byte stream through the synchronous information stream, and simultaneously, the plaintext byte stream and a key byte stream of a self-synchronizing sequence cipher are operated to be output as a cipher text, and the cipher text participates in next key production.
It should be further noted that the added synchronization information stream is generally three repetitions of synchronization information and 7E padding information, and the MCU controls the GPIO pin through a standard SPI protocol to implement sending and receiving of encrypted data, and the transmission employs a half-duplex mode.

Claims (6)

1. The one-way safe simple and convenient transmission device of the private protocol comprises a main packaging outer package (1) and is characterized in that a computer end interface (2) is fixedly connected to the center of the right end of the main packaging outer package (1), plastic shells (3) are respectively and fixedly connected to the two ends of the main packaging outer package (1), a cable output port (4) is formed in the center of the left end of the main packaging outer package (1), a circuit board (7) is movably connected to the inside of the main packaging outer package (1), a core circuit (9) is fixedly connected to the inside of the circuit board (7), an MCU is welded to the center of the upper end of the core circuit (9), a TYPE-C interface (5) is welded to the right side of the upper end of the core circuit (9), and an SPI wiring port (8) is welded to the left side of the upper end of the core circuit (9);
the MCU comprises a USB transmission interface, a safety detection module, a private transceiving protocol module and a data driving module;
the USB transmission interface is used for data transfer processing and power supply between the two groups of MCUs;
the safety detection module is used for overall safety protection of data and storage and scheduling of key parameters required by safety operation processing;
the private transceiving protocol module is used for carrying out private customization on an encapsulation protocol of a data stream and is solidified in the built-in chip in a read-only and encryption mode;
the data driving module specifically comprises a security check unit and a private transmission protocol unit;
the security inspection unit is used for performing security feature inspection on the data block, detecting the whole data file and searching and killing malicious codes, and simultaneously connecting a security module of the service private network part and performing security inspection according to the current configuration;
the private transmission protocol unit is used for splitting and combining the data, checking the integrity of the data and encrypting and decrypting the data in a self-organizing way.
2. The apparatus according to claim 1, wherein the security detection comprises the following steps:
the method comprises the following steps: monitoring the collected data flow, and performing rapid processing and hardware resource scheduling on the data packet;
step two: filtering unnecessary data through a filter, carrying out secondary processing on the filtered data, and respectively carrying out feature detection, metadata or file extraction and flow storage processing;
step three: detecting known attacks based on characteristics through a characteristic detection engine, realizing detection data preprocessing through metadata or file extraction, and realizing data retention evidence obtaining through flow storage;
step four: and generalizing the metadata and the events through a middleware, submitting the processed data to each group of detection engines and correlation engines for centralized detection, and finally outputting the detection result in a log or alarm form.
3. The device of claim 2, wherein said detection causes include an AI detection engine, an abnormal behavior detection engine, a document detection engine, a threat intelligence detection engine, a Yara/JA3/SSL detection engine.
4. The apparatus according to claim 1, wherein the splitting and combining specifically comprises the following steps:
step (1): classifying data into a group according to N bytes, wherein N is more than or equal to 1024 bytes, and parameters can be configured;
step (2): the data file information is put into the first group, the second group starts to import the data binary stream, and the last group receives the frame end identification or the data length/N residual part information.
5. The apparatus according to claim 4, wherein the data file information includes a file name, a creation time, a data size, and an integrity check code.
6. The apparatus according to claim 1, wherein the self-organizing encryption/decryption comprises the following steps:
the first step is as follows: before the data frame enters encryption, a synchronous information stream is added, and a plaintext byte stream is formed through the synchronous information stream;
the second step is that: the plaintext byte stream and the key byte stream of the self-synchronizing sequence password are operated to be output as ciphertext, and the ciphertext participates in the next key production;
the third step: after the program receives the data, positioning and decrypting the starting point and the advanced parameter information through the synchronous information flow, generating a flow according to the same secret key, and performing XOR operation to obtain a plaintext byte stream.
CN202111573981.5A 2021-12-21 2021-12-21 One-way safe transmission simple device of private protocol Pending CN114154609A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202111573981.5A CN114154609A (en) 2021-12-21 2021-12-21 One-way safe transmission simple device of private protocol

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202111573981.5A CN114154609A (en) 2021-12-21 2021-12-21 One-way safe transmission simple device of private protocol

Publications (1)

Publication Number Publication Date
CN114154609A true CN114154609A (en) 2022-03-08

Family

ID=80451651

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202111573981.5A Pending CN114154609A (en) 2021-12-21 2021-12-21 One-way safe transmission simple device of private protocol

Country Status (1)

Country Link
CN (1) CN114154609A (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050108518A1 (en) * 2003-06-10 2005-05-19 Pandya Ashish A. Runtime adaptable security processor
CN105812387A (en) * 2016-05-09 2016-07-27 北京航天数控系统有限公司 Unidirectional safe data exchange device
CN106788718A (en) * 2017-03-17 2017-05-31 河南省中远科技有限公司 A kind of one-way safety transmitting device, system and method based on VLC
CN111131154A (en) * 2019-11-19 2020-05-08 北京国铁盛阳技术有限公司 Network management data ferrying method and system, storage medium and computer equipment
CN111901418A (en) * 2020-07-28 2020-11-06 北京中科麒麟信息工程有限责任公司 External terminal protection equipment and system based on one-way file transfer protocol

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050108518A1 (en) * 2003-06-10 2005-05-19 Pandya Ashish A. Runtime adaptable security processor
CN105812387A (en) * 2016-05-09 2016-07-27 北京航天数控系统有限公司 Unidirectional safe data exchange device
CN106788718A (en) * 2017-03-17 2017-05-31 河南省中远科技有限公司 A kind of one-way safety transmitting device, system and method based on VLC
CN111131154A (en) * 2019-11-19 2020-05-08 北京国铁盛阳技术有限公司 Network management data ferrying method and system, storage medium and computer equipment
CN111901418A (en) * 2020-07-28 2020-11-06 北京中科麒麟信息工程有限责任公司 External terminal protection equipment and system based on one-way file transfer protocol

Similar Documents

Publication Publication Date Title
TWI616083B (en) Method and device for data transmission
CN102377803B (en) Data processing method, device and system
CN110324222B (en) Vehicle CAN bus data interaction system and interaction method thereof
CH641300A5 (en) DEVICE FOR TESTING AND ENSURE INTEGRITY of transmitted data.
CN102638565A (en) Mobile phone cloud encryption backup and recovery method based on cloud architecture
CN112243205A (en) Multi-protocol fusion processing method based on Internet of things
CN103139222A (en) Internet protocol security (IPSEC) tunnel data transmission method and device thereof
CN113452688B (en) Image encryption and decryption method and device based on SM4 and SM2 algorithms
CN108040098B (en) Network isolation method and system based on one-way transmission of visual information
CN111756627A (en) Cloud platform security access gateway of electric power monitored control system
CN103237036A (en) Device for realizing physical partition of internal and external networks
CN111556062B (en) Network security isolation device with one-way import function and method
CN114500068B (en) Information data exchange system based on safety isolation gatekeeper
CN114710558A (en) Asynchronous secure transmission channel construction method based on cloud storage
EP1944939B1 (en) Methods and apparatuses for performing ciphering in a wireless communications system
CN114154609A (en) One-way safe transmission simple device of private protocol
CN110011787A (en) A kind of data block fill method and device based on AES encryption algorithm
CN111464550B (en) HTTPS transparent protection method for message processing equipment
CN102999626B (en) A kind of data compression/decompression compression apparatus and method, system
CN111787052A (en) Telecommunication hierarchical management system
CN111931194A (en) Security monitoring big data processing method and device based on cloud computing
CN113225299A (en) Multi-path distributed power data transmission method and system based on two-dimensional code
CN106899600A (en) Data processing method and device of water purifier
CN103530342B (en) Method and device for sharing data
CN114928756B (en) Video data protection, encryption and verification method, system and equipment

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
RJ01 Rejection of invention patent application after publication

Application publication date: 20220308

RJ01 Rejection of invention patent application after publication