KR101499894B1 - Unidirectional Data Transfer Device over Ethernet Network - Google Patents

Abstract

The present invention relates to a unidirectional data transmission device in an Ethernet communication network, and more specifically, to a unidirectional data transmission device which is completely isolated in physical and electrical aspects so that data can be transmitted from a computer in a closed network to an external network, but the data can not be transmitted from a computer of the external network to the computer in the closed network, thereby fundamentally preventing a cyber breach from an external communications network. According to the present invention, a duplex communications is performed from the computer positioned in the closed network to the unidirectional data transmission device. However, only a simplex communications is performed through a single line cable for reception between the unidirectional data transmission device and the computer positioned in the external network, thereby fundamentally preventing the access from the external network to the closed network side.

Description

[0002] Unidirectional Data Transfer Device over Ethernet Network [0003]

The present invention relates to a unidirectional data transmission apparatus in an Ethernet communication network, and more particularly, to an unidirectional data transmission apparatus capable of transmitting data from a computer in a closed network to an external network while preventing data from being transmitted from a computer in the external network to a computer in the closed network And more particularly, to a unidirectional data transmission apparatus capable of originally blocking cyber infringement from an external communication network by physically and electrically isolating the same.

Ethernet network is one of the technologies widely used not only in information communication and general industry but also in nuclear industry. The data acquisition system of the industrial and power plant site receives the physical measurement signal provided by the field instrument and digitally processes it, and then monitors and controls it with various computer server or operator terminal via the device supplier communication network or Ethernet communication network. And calculation data. These data acquisition systems are generally divided into protection system, control system and monitoring system according to functional classification, all of which are composed of closed networks, and security levels are assigned differently according to functions and classes of system. In addition, the closed network and the separated external network are connected to the office automation devices that are not related to the operation of the power plant, and they can be connected to the Internet through various stages of firewalls and intrusion detection systems.

Background Art [0002] Conventional technologies used for communication link between a closed network having a different security level and an external network are as follows.

First, when bidirectional communication is required between a closed network and an external network, dedicated security equipment is generally used together with a firewall and an intrusion detection system. 1 is a diagram illustrating a prior art using a dedicated security device and a firewall. Referring to FIG. 1, commercial security devices are installed in a closed network and an external network, respectively. Dedicated security devices and firewalls function to block unauthorized access from the external network to the closed network. That is, bi-directional communication is performed with encrypted data through dedicated security equipment at both ends of the closed network and the external network. However, this method is advantageous in that bidirectional communication is possible, but there is still a possibility of infringement from the external network due to the bidirectional communication structure with the disadvantage of installing expensive commercial security equipment at both ends of the closed network and the external network. It is also inappropriate to apply such a two-way communication structure to data monitoring alone.

Second, a gateway computer is used to enhance communication security and isolate the communication network between systems or networks having different security levels. 2 is a diagram illustrating a prior art using a gateway computer. A gateway computer consists of a dual network host (called a 'Dual Homed Host') with two network interfaces (a transmitting computer and a receiving computer) and performs data routing and firewall functions. Firewall software or Intrusion Detection System (IDS) is installed on the gateway computer to block unauthorized access from the receiving computer side and to maintain communication independence so that communication faults on the receiving side are not propagated to the transmitting side .

Such a gateway computer or a firewall dedicated equipment will not be limited in use between networks having similar security levels or conditions. However, in applying the outbound and inbound security policies for the sending / receiving IP address and the service port, there is a possibility that the external access blocking may fail due to a security policy error or an administrator error have. Also, since these devices are exposed to administrator privileges through cyber infringement, it is impossible to block external intrusions at the source.

As described above, the conventional communication linking method has a problem that the vulnerability of cybersecurity can not be technically excluded. At the nuclear power plant, the network isolation design is basically applied according to the security level of each system. Major national infrastructure, including nuclear power plants, can cause fatal social disruption in the event of a cyber-infringement event, so that the closed network inside the main facility must be capable of blocking external cyber threats and providing the necessary information to the external network do.

SUMMARY OF THE INVENTION It is an object of the present invention to provide a method and apparatus for transmitting data from a computer in a closed network to an external network while at the same time physically and electrically isolating data from a computer in the external network to a computer in the closed network, It is an object of the present invention to provide a unidirectional data transmission apparatus capable of originally blocking cyber infringement.

According to an aspect of the present invention, there is provided an apparatus for performing unidirectional data transmission from a computer in a closed network to a computer in an external network, the apparatus comprising: To the computer side of the external network; A light receiving terminal for receiving a signal transmitted from a computer of the closed network and transmitting the signal to an input terminal of the optical splitter, and an optical transmitting terminal connected to an output terminal of the optical splitter and receiving an optical signal output from the distributor and transmitting the signal to a computer of the closed network A first optical port; And a second optical port connected to an output terminal of the optical distributor and including an optical transmission terminal for receiving an optical signal output from the optical distributor as an input and transmitting the optical signal to a computer of an external network, .

Preferably, the computer of the external network is n (n is an integer of 2 or more), and the optical splitter divides the inputted optical signal into n + 1, and the second optical port is connected to each computer of the external network 1: 1, and may have n optical transmission terminals for transmitting the optical signals output from the optical distributor to each computer of the external network.

In order to solve the above problems, the present invention provides an apparatus for performing unidirectional data transmission only on m (m is an integer of 2 or more) computers of an external network in a computer of a closed network, comprising two input terminals and m + A first optical splitter for dividing an optical signal input through one of the input terminals into m + 1 and outputting the optical signal; A second optical splitter which has one input terminal and two output terminals, receives one of the optical signals output from the first optical splitter, and splits the input optical signal into two, and outputs the split optical signal; A first optical receiving terminal for transmitting a signal transmitted from the computer of the closed network to an input end of the first optical splitter and a second optical transmitting terminal for transmitting the optical signal outputted from the second optical splitter to the computer side of the closed network, 1 optical port; The RJ-45 connector converts the signal transmitted through the RJ-45 connector into an optical signal and transmits the optical signal to the input terminal of the first optical splitter. The optical signal output from the second optical splitter is converted into an Ethernet signal used in the RJ- A first photoconversion port communicating to the computer side of the network; And a second optical port connected to each computer of the external network in a 1: 1 manner and having m optical transmission terminals for transmitting respective optical signals output from the first optical splitter to each computer of the external network, Wherein the computer of the first optical port is connected to any one of the first optical port and the first optical conversion port.

According to the present invention, duplex communication is performed from a computer located in a closed network to a unidirectional data transmission apparatus. However, simplex communication is performed between a unidirectional data transmission apparatus and a computer located in the external network through a single wire cable for reception, The access from the external network to the closed network side can be blocked at the source.

FIG. 1 is a diagram illustrating a conventional technique using a dedicated security device and a firewall.
2 is a diagram illustrating a prior art using a gateway computer.
3 is a block diagram of a unidirectional data transmission apparatus in an Ethernet communication network according to a first embodiment of the present invention.
4 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a second embodiment of the present invention.
5 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a third embodiment of the present invention.
6 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a fourth embodiment of the present invention.
7 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a fifth embodiment of the present invention.

The present invention is capable of various modifications and various forms, and specific embodiments are illustrated in the drawings and described in detail in the text. It should be understood, however, that the invention is not intended to be limited to the particular forms disclosed, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In the present application, the terms "comprising" or "having ", and the like, are intended to specify the presence of stated features, integers, steps, operations, elements, parts, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, parts, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted as ideal or overly formal in meaning unless explicitly defined in the present application Do not.

The present invention relates to an apparatus for unidirectional data communication between a transmitting computer of a closed network connected to an Ethernet network or a closed network and a receiving computer of an external network or an external network. The unidirectional data transmission device in the Ethernet communication network according to the present invention is installed between a computer located in a closed network and a computer located in an external network so that only a computer located in a closed network can transmit data to a computer located in the external network, In the case of a computer located on the same computer, physical access to the computer located in the closed network is disabled. Duplex communication is performed through a cable of a double core wire (transmission and reception) from a computer located in a closed network to a unidirectional data transmission device. However, a unidirectional data transmission device and a computer of the external network are connected in a single direction (Simplex Communication).

The unidirectional communication apparatus according to the present invention basically includes an optical splitter. When the Ethernet connection is not an optical cable but an RJ-45 UTP (Unshielded Twisted Pair) cable, an optical media converter is further included .

The computer located in the closed network can confirm that the normal data link is established by receiving the signal transmitted through the optical distributor in the unidirectional data transmission apparatus according to the present invention. The optical distributor connected to the transmission line side of the computer located in the closed network replicates the transmission signal of the closed network computer equally and distributes the signal to the computer of the external network and the signal for receiving the closed network computer. Using this principle, a computer in an external network can receive transmission data from a transmitting computer with only a receiving cable.

While the present invention enables data transmission from a computer of a closed network to an external network, it completely isolates the cyber infringement from the external communication network by physically and electrically isolating the data from the computer of the external network to the computer of the closed network .

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

3 is a block diagram of a unidirectional data transmission apparatus in an Ethernet communication network according to a first embodiment of the present invention.

Referring to FIG. 3, the unidirectional data transmission apparatus 100 in an Ethernet communication network according to the present invention performs unidirectional data transmission from a closed network to an external network. The apparatus includes an optical distributor 110, a first optical port 130, A second optical port 140, and may further include a closed network 200, and an external network 300.

The optical distributor 110 is a device for performing a function of branching the input optical signal into a plurality of optical signals, and is a passive element used in a point-to-multipoint network such as an Internet subscriber network. The optical splitter 110 is used as a basic component in an IEEE 802.3ah passive optical network (EPON). Depending on the application, a 2 x 2 optical splitter, a 1 x 3 optical splitter, a 1 x N optical splitter And is used as various kinds of input / output branching elements. The optical distributor 110 replicates UDP / IP protocol communication packets transmitted in a broadcasting manner from a transmitting computer to a receiving computer.

In the embodiment of FIG. 3, the optical splitter 110 receives one optical signal from the optical reception terminal Rx of the first optical port 130, splits the input optical signal into two, and outputs the split optical signal. One output of the optical splitter 110 is connected to the optical transmission terminal Tx of the second optical port 140 and the other output is connected to the computer of the closed network 200. The optical distributor 110, the first optical port 130, and the second optical port are connected to each other through optical cables to transmit and receive optical signals for Ethernet.

Meanwhile, the other output of the two outputs of the optical distributor 110 is connected to the second optical port 140 through the optical cable. The second optical port 140 includes an optical transmission terminal Tx for receiving one of the signals output from the optical splitter 110 as an input and transmitting the optical signal to a computer located in the external network 300 . The second optical port 140 may not include a light receiving terminal because it does not allow communication from the computer located in the external network 300 to the closed network side.

As a result, the Ethernet signal transmitted from the computer side of the closed network 200 is transmitted to the optical receiving terminal Rx of the first optical port 130, the optical distributor 110, and the optical transmitting terminal Tx of the first optical port 130, And then returns to the computer of the closed network 200 in order.

At the same time, the Ethernet signal transmitted from the computer side of the closed network 200 is transmitted to the optical receiving terminal Rx of the first optical port 130, the optical distributor 110 and the optical transmitting terminal Tx of the second optical port 140 In turn, to a computer located in the external network 300.

In the following embodiments, each component performs the same function as each component in the embodiment of FIG. 3, so that detailed description and duplicate description will be omitted.

4 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a second embodiment of the present invention.

The embodiment of FIG. 4 differs from the embodiment of FIG. 3 in that an optical splitter is used for splitting one input into three or more outputs and one of the outputs of the optical splitter is connected to the computer side of the closed network, And the remaining outputs are provided to a plurality of computers located in the external network. One of the plurality of computers located in the external network is operated for normal operation and the remaining computers are operated for spare, thereby ensuring the stability of the entire system.

In FIG. 4, the optical distributor 111 uses an optical splitter for splitting one input into three outputs, but it is also possible to branch to three or more outputs instead of three. If the number of computers of the external network 300 is n (n is an integer of 2 or more), the optical distributor 111 divides one input into n + 1 outputs in accordance with the number of computers located in the external network 300 You can branch.

The second optical port 140 is connected to each of the computers located in the external network 300 at a ratio of 1 to 1 and transmits the optical signals output from the optical distributor 111 to each computer located in the external network 300 And may include an optical transmission terminal. Although only two optical transmission terminals 141_1 and 141_2 are shown in FIG. 4, it is natural that the second optical port 140 can have three or more optical transmission terminals.

One of the outputs of the optical distributor 111 is connected to the optical transmission terminal Tx of the first optical port 130 through the optical cable and the remaining outputs are connected to the second optical port 1, respectively, to the n optical transmission terminals Tx.

Each of the optical transmission terminals 141_1 and 141_2 transmits the optical signal received from the optical splitter 111 to each of the computers located in the external network 300 through the optical cable.

5 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a third embodiment of the present invention.

5 is an embodiment in which a computer located on the closed network 200 and / or the external network 300 side is connected to the unidirectional data transmission apparatus 100 using an RJ-45 connector other than optical Ethernet.

The first optical port 130 may further include an optical media converter 135 for converting Ethernet connected to the RJ-45 connector into optical Ethernet and the second optical port 140 may also include an Ethernet And an optical media converter 145 for converting optical media to optical Ethernet.

The optical media converters 135 and 145 are connected to the UTP (Unshielded Twisted Pair), STP (Shielded Twisted Pair Cable), and FTP (Foil Screened Twisted Pair Cable) using RJ- Which is used when an RJ-45 connector other than the Ethernet optical communication is used on the transmission / reception side and is used for converting an optical medium converter having the same size as that of the communication network applied to the optical medium, Is applied.

When a computer located on the closed network 200 and / or the external network 300 performs Ethernet communication using an RJ-45 connector instead of the Ethernet optical communication, the optical media converters 135 and 145 ).

Meanwhile, the power supply unit 170 supplies power to the two optical media converters 135 and 145, respectively.

6 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a fourth embodiment of the present invention.

In the embodiment of FIG. 6, at least one of the computers located on the side of the external network 300 is connected to the unidirectional data transmission apparatus 100 using an RJ-45 connector other than optical Ethernet.

When any computer located on the side of the external network 300 performs Ethernet communication using an RJ-45 connector instead of the Ethernet optical communication, it is connected to the optical media converters 135 and 145 through a UTP, STP, or FTP cable.

Although the computer located in the closed network 200 is shown in FIG. 6 as performing the Ethernet communication using the RJ-45 connector, it may be configured to perform the Ethernet communication using the optical port 130 as in the embodiment of FIG. 3 or FIG. Of course.

7 is a block diagram illustrating a unidirectional data transmission apparatus in an Ethernet communication network according to a fifth embodiment of the present invention.

The embodiment shown in FIG. 7 includes both an optical port for Ethernet optical communication and an optical media converter that can be connected to an RJ-45 connector, both of which are connected to the closed network 200 and the external network 300, The computer and the computer located in the external network 300 can be connected to the unidirectional data transmission apparatus 400 using any kind of Ethernet cable.

The unidirectional data transmission device 400 in the Ethernet communication network according to the embodiment of FIG. 7 can transmit unidirectional data (m is an integer of 2 or more) to a computer located in the external network 300 in a single computer located in the closed network 200 And includes a first optical splitter 410, a first optical port 430, a second optical port 440, a photo-conversion port 450 and a second optical splitter 460, 200, an external network 300, and a power supply unit 470.

The first optical splitter 410 has two input terminals and m + 1 output terminals. The first optical splitter 410 splits an optical signal inputted through one input terminal into m + 1 outputs. Although an optical splitter is shown in Fig. 7 for splitting two inputs into three outputs, it is of course possible to use an optical splitter that branches to four or more outputs.

The second optical splitter 460 has one input terminal and two output terminals, and divides the inputted optical signal into two and outputs the divided optical signal.

The first optical port 430 includes a first optical receiving terminal Rx and a second optical splitter 460 for transmitting the optical signal inputted from the computer located in the closed network 200 to the input end of the first optical splitter 410, And a second optical transmission terminal Tx for transmitting one of the optical signals output from the first optical transmission terminal 200 to the computer side of the closed network 200.

The photo-conversion port 450 includes an optical media converter for converting a signal transmitted through the RJ-45 connector into an optical signal. The optical conversion port 450 receives the Ethernet signal transmitted through the RJ-45 connector from the computer located on the closed network 200 side and transmits the received Ethernet signal to the input terminal of the first optical splitter 410, And converts the optical signal into an Ethernet signal of a UTP cable using an RJ-45 connector and transmits the Ethernet signal to a computer located in the closed network 200.

The second optical port 440 includes m optical transmission terminals 1: 1 connected to m output terminals among m + 1 output terminals of the first optical splitter 410, and each optical port of the second optical port 440 The transmitter transmits each optical signal output from the first optical splitter 410 to each computer located in the external network 300.

On the other hand, at least one of the m optical transmission terminals of the second optical port 440 is an optical medium converter for converting an Ethernet optical signal output from the first optical splitter 410 into an Ethernet signal using an RJ-45 connector (445). When a computer located in the external network 300 uses an RJ-45 connector, the computer located in the external network 300 is connected to the RJ-45 connector of the optical media converter 445.

7, since the first optical splitter 410 uses an optical splitter that splits the two inputs into three outputs, the second optical port 440 includes one optical media converter 445 and one optical transmission terminal 441, and two transmission terminals 441, 445. Of course, if all of the computers located in the external network 300 use optical Ethernet, the second optical port 440 may be configured to be composed only of the optical transmission terminal, and all the computers located in the external network 300 may connect the RJ-45 connector If utilized, the second optical port 440 may be configured to be all optical media converters. As a result, the configuration of the second optical port 440 can be flexibly changed according to the type of the Ethernet cable used by the computer located in the external network 300.

As also described above, the first optical splitter 410 may split two inputs into m + 1 outputs, in which case the second optical port 440 may have m transmit terminals.

In the embodiment of FIG. 7, the computer located in the closed network 200 may be selectively connected to either the first optical port 430 or the photo-conversion port 450, depending on the type of the Ethernet cable used. The computer located in the closed network 200 is connected to the first optical port 430 through the optical cable when the optical Ethernet is used and to the optical conversion port 450 through the UTP cable when the RJ-45 connector is used.

Each of the plurality of computers located in the external network 300 may be connected to the optical transmission terminal or the optical media converter according to the type of the Ethernet cable used. The computer located in the external network 300 is connected to the optical transmission terminal 441 of the second optical port 440 through the optical cable when the optical Ethernet is used and is connected to the optical transmission terminal 441 of the second optical port 440 through the UTP cable, To the RJ-45 connector of the optical media converter 445 of the optical disk 440.

In the present invention, the optical media converter can satisfy all the Ethernet network standards by using the standards required at various Ethernet network speeds (10 Mbps, 100 Mbps, 1 Gbps).

The unidirectional data transmission apparatuses 100 and 400 and the unidirectional data transmission apparatuses 100 and 400 perform duplex communication although the computer located in the closed network 200 performs duplex communication. Since only one-way communication (simplex communication) is performed through the disconnection cable between the computers located, the access from the external network to the closed network side can be fundamentally blocked.

In addition, according to the present invention, an optical distributor for unidirectional data transfer function is a simple passive element and can be used semi-permanently without failure, and it is required to have an active device such as a firewall, a dedicated security device or a gateway computer, It is possible to realize a unidirectional communication security function at a low cost.

Also, according to the present invention, a unidirectional data transmission apparatus can selectively use an Ethernet LAN cable to which a computer located in a closed network and / or an external network uses an optical cable or an RJ-45 connector by using an optical media converter, Directional communication from one computer of the closed network to a plurality of multiplexed computers of the external network by using an optical distributor for branching and outputting the optical signal into three or more optical signals.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the invention. Accordingly, the scope of protection of the present invention should be construed in accordance with the following claims, and all technical ideas within the scope of equivalents and equivalents thereof should be construed as being covered by the scope of the present invention.

100, 400: Unidirectional data transmission device
110, 111, 410, 460: optical distributor
130, 430: a first optical port
140, 440: a second optical port
145, 445: optical media converter
450: Photoconversion port
141, 441: optical transmission terminal
170, 470: Power supply
200: Closed network
300: external network

Claims (7)

An apparatus for performing unidirectional data transmission from a computer of a closed network to a computer of n (n is an integer of 2 or more)
An optical distributor for branching and outputting the input optical signal into (n + 1) optical signals, and delivering optical signals branched out to a computer of the closed network and a computer of the external network;
A light receiving terminal connected to an output terminal of the optical splitter and receiving an optical signal output from the optical splitter and transmitting the optical signal to a computer of the closed network; A first optical port including an optical transmission terminal to which the optical signal is transmitted; And
The optical splitter receives the optical signal output from the optical splitter and transmits the optical signal to the computer of the external network. The optical splitter is connected to each computer of the external network in a 1: 1 ratio, And a second optical port having n optical transmission terminals for transmitting each optical signal to each computer of the external network. delete The method according to claim 1,
The first optical port is an optical media converter for converting Ethernet connected to the RJ-45 connector into optical Ethernet,
Wherein the computer of the closed network is connected to the optical media converter via an RJ-45 connector. The method according to claim 1,
The second optical port is an optical media converter for converting optical Ethernet into Ethernet connected through an RJ-45 connector,
Wherein the computer of the external network is connected to the optical media converter via an RJ-45 connector. The method according to claim 1,
At least one of the n optical transmission terminals of the second optical port is an optical media converter for converting Ethernet connected to the RJ-45 connector into optical Ethernet,
Wherein the computer of the external network is connected to the optical media converter when using an RJ-45 connector. An apparatus for performing unidirectional data transmission from a computer in a closed network to m (m is an integer of 2 or more) computers in an external network,
A first optical splitter having two input terminals and m + 1 output terminals, splitting the optical signal input through any one input terminal into m + 1 outputs, and outputting the split optical signals;
A second optical splitter which has one input terminal and two output terminals, receives one of the optical signals output from the first optical splitter, and splits the input optical signal into two, and outputs the split optical signal;
A first optical receiving terminal for transmitting a signal transmitted from a computer of the closed network to an input end of the first optical splitter and a second optical transmitting terminal for transmitting an optical signal outputted from the second optical splitter to a computer side of the closed network, A first optical port including a first optical port;
The RJ-45 connector converts the signal transmitted through the RJ-45 connector into an optical signal and transmits the optical signal to the input terminal of the first optical splitter. The optical signal output from the second optical splitter is converted into an Ethernet signal used in the RJ- A first photoconversion port communicating to the computer side of the closed network; And
And a second optical port connected to each computer of the external network in a 1: 1 manner and having m optical transmission terminals for transmitting optical signals output from the first optical splitter to each computer of the external network,
Wherein the computer of the closed network is connected to any one of the first optical port and the first optical conversion port. The method according to claim 6,
At least one of the m optical transmission terminals of the second optical port is an optical media converter for converting optical Ethernet to Ethernet connected by an RJ-45 connector,
Wherein the computer of the external network is connected to the optical media converter when using an RJ-45 connector.

Images