Network safety system based on the server data exchange
Technical field
The utility model relates to a kind of network safety system, particularly relates to a kind of network safety system based on the server data exchange.
Background technology
Along with network technology constantly develops, improving constantly of PC unit performance, network is to everyone is indispensable now, it has information inquiry efficiently, functions such as information communication easily, people can stay indoors and just can obtain us and want the information understood, make things convenient for medium-sized and small enterprises to come Information Monitoring, understand first hand market, so as in intense market competition dominate.What is a server so server is widely used in network facet now? server is a kind of high-performance computer, and as the node of network, therefore 80% data, information are also referred to as the soul of network on storage, the processing network.Server system can be a kind of information mode with all information type set such as Email, voice, paging, mobile short-message, fax and multi-medium data, and any reception in the communication equipments such as available phone, fax, mobile phone, pager, PC, palmtop PC, PDA handles, and framework plays an information interconnecting channels between wired, wireless, the Internet.Implementing in full of server can really realize and ERM system of enterprise and ecommerce perfect adaptation, will change traditional working way and life style.Medium-sized and small enterprises utilize this server system all can give full play to Enterprise Information Resources, application such as the phone of enterprise, fax, mail, ERM/CRM are focused on finish on the station server, break through the restriction of original working way and customer service mode, the communication service and the information service of providing convenience to enterprise staff, client, and can utilize oneself information resources, easily develop the information content and the E-business service that shows unique characteristics, improved service ability comprehensively and obtained more inputs repayment.Every profession and trade enterprise servers system, can make enterprise staff at any time and any place, by any way, obtain enterprises and outside various information, simultaneously also can be by making up the corporate client service system, more preferably the client provides personalized service more targetedly, satisfies client's actual demand.Therefore, the information communication channel that it not only provides convenience unobstructed, and can improve enterprise work efficient greatly, cut operating costs, promote the corporate client image, to improve the comprehensive competitive power of enterprise.The user can enjoy omnibearing unified information service, no matter be at home, on the way, still in office or hotel, can handle individual, client's voice messaging, fax and Email whenever and wherever possible, the convenience that enjoys cybertimes to the full is with quick.Traditional enterprise information system is telephone system (phone, a fax), modern enterprise information system becomes increasingly complex, comprise isolated each other, the nothing contacts mutually of all multisystems such as telephone system (phone, fax), LAN system (Internet visit gateway, Email), access service system, enterprise management system, e-commerce system, enterprise has to set up respectively application servers such as remote access server, Internet gateway server, e-mail server, ERM/CRM, uses to support various information.
Server is that the safety problem of very important network device server is the basis that ensures all application to network now as known from the above.For a regular network, have dissimilar servers, as dns server, Web server, mail server or the like.Also have and use general PC to provide Internet to connect the main frame of shared and some simple Web services as network.The Internet of whole LAN (local area network (LAN)) inserts and has leaned on it, if it goes wrong, gently then client computer be could not get on to the Net, heavy then whole network paralysis.Hostile network behavior to the webserver comprises three aspects: the one, and the attack of malice, as Denial of Service attack, internet worm or the like, these behaviors are intended to consume server resource, influence the normal operation of server, even the paralysis of server place network; Another one is exactly the intrusion behavior of malice, and this behavior can cause the server sensitive information leakage especially, and the invador can do at will especially, destroys server wantonly.Last aspect is exactly the security breaches that server itself is had.The webserver is meant that mainly those deposit website data DATA server, dns server and MAIL server.The problem of WEB server had been said many, just learnt about the problem of DATA server, dns server and MAIL server earlier here.
One, DATA server
Look at the DATA server first.It mainly is the server in store data storehouse.With the SQL database is example, considers from security standpoint, and sql server is the same with all programs in the BACKOFFICE assembly, all is based on Windows Server, has utilized the owned security performance of WindowsServer.And when you linked to each other sql server with Internet, for guaranteeing your safety of data and integrality, you needed special consideration some thing.
Two, dns server
Dns server is the basis that Internet goes up other service, and its handles the request of DNS client computer: name and IP address are exchanged, and other publish information (write down as MX etc.) that particular host is provided.Generally speaking, webmasters are run into has following several situation mostly.
1. name deception.When host B was visited host A (simultaneously also as dns server) as execution rlogin, A received this connection and obtains to initiate the IP address of this connection host B.For verifying the legitimacy of this connection, host A just to the reverse inquiry of local dns server corresponding to this IP address of host name.When returning Query Result---during main frame that host name B trusts for this machine, just allow remote command rlogin from B.Below we look at again main frame D be how to utilize the checking leak cheat host A.When main frame D also carried out rlogin, host A will be verified the legitimacy of this connection equally.If when A can not inquire corresponding host name according to the IP of D in local dns server, will send request, can find dns server C eventually at last to other dns server.If when the invador revised among the dns server C corresponding to own IP address of host host B by name, the IP address of host name that host A will obtain corresponding to D was the reverse Query Result of B, so host A is approved this connection.So deception A success.
2. Information hiding.Needs when certain enterprise owing to reasons such as maintaining secrecy give some particular host with specific internal host name, and the invaded person of these main frame passwords is when obtaining, and the server host of depositing private data will expose fully.
Three, MAIL server
The MAIL server becomes the object of numerous online friends' complaint always because of its fail safe.Really, theoretically, the MAIL service is a kind of unsafe service, because it must accept the nearly all data from INTERNET.On the Internet, the mail exchange between server is finished by smtp protocol.The smtp server of main frame receives mail (this mail may be from the smtp server on the external host, also may from the user agent on this machine), checks addresses of items of mail then, still is forwarded to some other main frame so that decision sends at this machine.SMTP program in the Unix system is Sendmail normally.The safety problem important reasons of relevant Sendmail is that it is a unusual complicated program, and Another reason is its need root user privileges operation.
What generally adopt in settlement server safety is the method for software, or utilizes fire compartment wall that the information from external network is filtered, and detects interception.Adopt powerful network operating system, do safe system's gamete, adopt effective antivirus software to play a role, but the network security software of the all-pervasive safety again of the hacking technique of becoming stronger day by day and fire compartment wall all can only be guaranteed can not tackle the problem at its root safely for the moment to server security.
The utility model content
The purpose of this utility model is to provide a kind of safe and reliable network safety system based on the server data exchange.
For achieving the above object, technical solution of the present utility model is:
The utility model is a kind of network safety system based on the server data exchange, and it comprises internal network server, external network server and network security separate card; Internal network server links to each other by grid line, serial ports, parallel port, USB mouth with external network server, and described network security separate card is arranged between internal network server and the external network server.
After adopting such scheme, because the exchanges data of server system, between two-server, carry out active data transmission and exchange exactly, promptly the useful data on the station server is transferred on another station server, the utility model uses two high performance webservers to provide data resource as the user, one station server is in Intranet, and another station server is in outer net, network security separate card is installed on server, physically two-server is linked to each other, two-server just can carry out the active data transmission completely like this.The utility model is from physically isolating classified network and public network; avoided in-house network to suffer the attack of outside hacker, virus; reached the information security policy of " this shared will sharing; also will protecting of this protection "; can save 75% for solving the man power and material that the intranet and extranet isolation drops into, save the network rebuilding input of more than one hundred million units for units such as government, finance.Comparing this system with present shielding system on the market all improves a lot at aspects such as low-cost, easily installation, performance, stability, functions.
Below in conjunction with the drawings and specific embodiments the utility model is further described.
Description of drawings
Fig. 1 is a structural representation of the present utility model.
Embodiment
As shown in Figure 1, the utility model is a kind of network safety system based on the server data exchange, and it comprises internal network server 1, external network server 2 and network security separate card 3.
Internal network server 1 links to each other by grid line, serial ports, parallel port, USB mouth with external network server 2, makes to carry out active data transmission and exchange between the two-server.Described network security separate card 3 is arranged between internal network server 1 and the external network server 2.
Operation principle of the present utility model:
The exchanges data of server system, between two-server, carry out active data transmission and exchange exactly, promptly the useful data on the station server is transferred on another station server, the utility model uses two high performance webservers to provide data resource as the user, an internal network server 1 is in Intranet (handling the in-house network of confidential document), and another external network server 2 is in outer net (extranets that connect the Internet).Network security separate card 3 is installed on server, physically two-server (internal network server 1 and external network server 2) is linked to each other, two-server just can carry out the active data transmission completely like this, at this moment just can directly be transferred to external network server to the information that inside is wanted to be published to outer net, also the data that outer net is collected can be aggregated into interior network server.If network security separate card 3 is not installed, after two-server was linked to each other, Intranet just was directly exposed in the Internet so, and at this moment in-house network is being not inner classified network, wherein had the classified information of pipe will be subjected to malicious attack from the external interconnect net.And network security separate card 3 can be basic from physically solving the safety problem of Intranet information, when using network security separate card 3 to link to each other two-server, server is in completely in the physical connection, connecting line and internal network server 1 disconnection by network security separate card 3 when external network server 2 provides the Internet resource for the user, at this moment internal network server 1 disconnects completely, be not connected with external network, if want the information storage that obtains from outer net to in-house network the time, earlier information storage externally on the webserver 2, disconnect with the external interconnect net by network security separate card 3 then and linking to each other with internal network server 1, at this moment no matter be external network server 2 or internal network server 1, just look like to be in one completely in the internal environment.The disconnecting external Internet with when in-house network is connected, begin to carry out transfer of data, so because two-server has effectively prevented the attack from the outside in the internal environment of a complete closed.When wanting to be distributed on the information of in-house network on the Internet, network security separate card 3 disconnects with and external interconnect net automatic by the netting twine switching, link to each other with internal network server 1 then, two-server is in the security context of an inside like this, internal network server 1 is wanting information releasing to be transferred on the external network server 2, isolation card is switched by netting twine again behind the end of transmission, be connected with the external interconnect net with internal network server 1 disconnection, at this moment internal network server 1 is in fully in the internal security environment and is not connected with any external network, avoids internal network server 1 to suffer external attack.So adopt physical isolation scheme of the present invention, realized safety guarantee completely, guarantee integrality, availability and the fail safe of server data.
Interior network server will be published to outer net with information; outer network server disconnection is connected with external network; at this moment the information of internal network is transferred on the external network server 2 by network security separate card 3; in the time of end of transmission; network security separate card 3 disconnects the connection of two-server; simultaneously external network server 2 is linked to each other with the external interconnect net, Intranet just be in one not with the state of any network interconnection in outside in, thereby effectively protected inner classified information.From as can be seen above, network security separate card 3 is exactly under a kind of state of physical security completely, has guaranteed two-server transfer of data safely and fast, is different from existing server clastotype.
The selection of the utility model communication modes:
The network security separate card system is realizing on the basis that safety is isolated several communication modes being arranged.
1. manual switchover mode: i.e. direct-cut operation.Its maximum characteristics are to need not install software.Intranet and extranet just show by the indicator light on the hand switch or its button.It is superseded that such isolation card has been tending towards on market.
2. serial communication mode: it is by software control, realizes the switching of computer network state.The communication modes of isolation card and computer is realized by serial ports.Its maximum characteristics, intelligent high, can monitor out current network state automatically.And friendly interface, easy to use, also have functions such as floppy disk, CD prompting.Comparatively general on such isolation card market.
3.PCI interface mode: it is that mode by software control realizes internal-external network status detection and switching, and the characteristics of comparing its maximum with the serial communication mode are to have saved limited serial port resource.Pci bus is a kind of local bus that does not depend on certain concrete processor.On structure, PCI is the one-level bus of inserting between CPU and original system bus, and specifically by the management of a bridgt circuit realization to this one deck, and the interface between realizing up and down is with the transmission of coordination data.Manager provides signal damping, makes it to support 10 kinds of peripheral hardwares, and can keep high-performance under high clock frequency.Pci bus is the snoop bus master technology also, allows smart machine to obtain bus control right when needed, transmits with expedited data.Its main performance is supported 10 external equipments, maximum data transfer rate 133MB/S, and clock synchronization mode is not subjected to 32 of CPU and clock frequency influence highway widths (5V) 64 (3.3V), and can discerns external equipment automatically.
And server system requires whole performance, to provide Internet resources as much as possible for the network user, fast corresponding reflection is made in user's's (trigger condition or stipulated time realization automatic switchover being set by system) request, so isolation card of the present utility model adopts most effective pci interface mode to carry out communication with computer.