KR102333245B1 - System and method for supporting between heterogeneous networks communication using unidirectional communication - Google Patents

Abstract

Disclosed are a heterogeneous inter-network communication system and method using unidirectional communication. A heterogeneous inter-network communication system using unidirectional communication according to an aspect of the present invention is connected to an optical transmission line having a ring flow path of a one-way circulation structure, an internal network, and receives data from an internal network host, and the reception An internal network transmission control server that transmits the received data to an external network reception control server through the optical transmission line, is connected to an external network, receives data from the internal network transmission control server, and transmits the received data to the optical transmission line An external network reception control server that transmits to an external network transmission control server through a control server, an internal network reception control server connected to the internal network, transmitting data from the external network transmission control server, and transmitting the received data to the internal network transmission control server through the optical transmission line; , the optical transmission line is characterized in that the diode is connected in one direction to transmit data in the order of the internal network transmission control server, external network reception control server, external network transmission control server, and internal network reception control server.

Description

Heterogeneous manganese communication system and method using one-way communication

The present invention relates to a heterogeneous network communication system and method using unidirectional communication, and more particularly, by using a pair of data diodes in different directions (forward and reverse), unidirectional communication capable of transmitting stream data while maintaining unidirectional characteristics as it is. It relates to a heterogeneous manganese communication system and method using the same.

In a network separation environment, a unidirectional data transmission system is used to transmit data in the forward unidirectional direction from the internal network (security area) to the external network (non-security area), or to transmit data in the reverse unidirectional direction from the external network to the internal network do.

In other words, a unidirectional security gateway method with physical unidirectional characteristics, such as a data diode method, is used for data interworking between separate networks composed of different security levels into internal and external networks. Alternatively, a direct interlocking method such as a storage method is using a manganese data transmission product.

Among the data transmission products between networks, the storage method or relay server type is a form that allows bidirectional transmission, but it adopts an indirect interworking method such as an automatic transfer switch (ASR, Automatic Send/Receive Set). Due to transmission limitations, there is a problem in interworking of real-time stream data.

Another type of one-way secure gateway transmission device can maintain a safe security area by fundamentally blocking access from the external network by using only the transmission function to completely physically separate the internal network and the external network. However, since this method cannot receive external information, it is impossible to receive external data necessary for the operation of the internal network, so there is a limit in establishing a safe and reliable internal network operating environment in the complicated current internal network operating environment.

As prior art related to the present invention, Republic of Korea Patent Publication No. 2018-0009908 (published on January 30, 2018, title of invention: an indirect interworking method through an internal network transmission control server in a network separation environment, a recording medium for performing the same, and system) is there.

The present invention has been devised to improve the above problems, and an object of the present invention is to provide a heterogeneous network communication system using unidirectional communication that enables stream data transmission in both directions while maintaining unidirectional safety of a data diode method, which is a unidirectional characteristic, and to provide a way

The problem to be solved by the present invention is not limited to the problem(s) mentioned above, and another problem(s) not mentioned will be clearly understood by those skilled in the art from the following description.

A heterogeneous inter-network communication system using unidirectional communication according to an aspect of the present invention is connected to an optical transmission line having a ring flow path of a one-way circulation structure, an internal network, and receives data from an internal network host, and the reception An internal network transmission control server that transmits the received data to an external network reception control server through the optical transmission line, is connected to an external network, receives data from the internal network transmission control server, and transmits the received data to the optical transmission line An external network reception control server that transmits to an external network transmission control server through a control server, an internal network reception control server connected to the internal network, transmitting data from the external network transmission control server, and transmitting the received data to the internal network transmission control server through the optical transmission line; , the optical transmission line is characterized in that the diode is connected in one direction to transmit data in the order of the internal network transmission control server, external network reception control server, external network transmission control server, and internal network reception control server.

In the present invention, the internal network transmission control server transmits data received from the internal network host to an internal network transmission agent that applies or transmits data received from the internal network host to an internal network transmission optical transmission device, and transmits data received from the internal network transmission agent to an SRL (Secure Ring) Link) packet and transmit the SRL packet to the external network reception control server through the optical transmission line.

In the present invention, the external network reception control server analyzes the SRL packet received from the internal network transmission control server, and transmits the SRL packet to the external network reception agent or the external network through the optical transmission line according to the analysis result. It may include an external network reception optical transmitter that transmits to the transmission control server, and an external network reception agent that applies the SRL packet transmitted from the external network reception optical transmitter.

In the present invention, the external network transmission control server analyzes the SRL packet received from the external network reception control server, and transmits the SRL packet to the external network transmission agent or the internal network through the optical transmission line according to the analysis result. It may include an external network transmission optical transmission device for transmitting to the reception control server, and an external network reception agent applying data transmitted from the external network transmission optical transmission device.

In the present invention, the internal network reception control server analyzes the SRL packet received from the external network transmission control server, and transmits the SRL packet to the internal network reception agent or the internal network through the optical transmission line according to the analysis result. It may include an internal network reception optical transmission device for transmitting to the network transmission optical transmission device, and an internal network reception agent applying data transmitted from the internal network reception optical transmission device.

In the present invention, the SRL packet may be composed of a header and data including a purpose (SRL_FLAG), a counter (SRL_CNT) for classifying the number of relays to a destination, and a control server identifier (Upload_ID).

In the present invention, each of the internal network transmission optical transmission device, external network reception optical transmission device, external network transmission optical transmission device, and internal network reception optical transmission device transmits an SRL packet to an interface unit for communication with an agent and another control server. It may include a unidirectional optical transmitter for transmitting and a unidirectional optical receiver for receiving SRL packets from other control servers.

In the present invention, the unidirectional optical transmitter includes a multiplexer that multiplexes SRL packets for distribution and relay of the data, an encoder that encodes the multiplexed SRL packet, and a transmitter that transmits the encoded SRL packet to the optical transmission line may include

In the present invention, the unidirectional optical receiver determines whether the receiver that receives the SRL packet through the optical transmission line, the decoder that decodes the received SRL packet, and the control server identifier of the decoded SRL packet correspond to their values. Receive packet processing unit that determines and uploads the SRL packet to the agent through the interface unit if it is a value corresponding to itself, decrements the value of the counter if it is not a value corresponding to itself may include

In the present invention, the optical transmission line may be formed on diodes in different directions.

A heterogeneous network communication method using one-way communication according to an aspect of the present invention is a heterogeneous network communication using one-way communication including an internal network transmission control server, an external network reception control server, an external network transmission control server, and an internal network reception control server. A method for transmitting a security policy in a system, wherein when the internal network transmission agent of the internal network transmission control server receives a security policy distribution command from the internal network security server, the internal network optical transmission device of the internal network transmission control server distributes the security policy generating an SRL packet and transmitting it to the external network reception control server; an external network reception optical transmission device of the external network reception control server analyzes the security policy distribution SRL packet to determine whether to upload it, and if it is an upload target, the It uploads an SRL packet to the external network reception agent, transmits the first relay SRL packet in which the counter value of the SRL packet is reduced, to the external network transmission control server, and decreases the counter value of the SRL packet if it is not an upload target. transmitting a first relay SRL packet to the external network transmission control server; an external network transmission optical transmission device of the external network transmission control server analyzes the first relay SRL packet to determine whether the packet is an upload target, and if it is an upload target Uploads the first relay SRL packet to the external network transmission agent 410, and transmits a second relay SRL packet in which the counter value of the first relay SRL packet is decremented to the internal network reception control server. case, transmitting a second relay SRL packet in which the counter value of the first relay SRL packet is decreased to the internal network reception control server; is analyzed to determine whether or not the upload target is an upload target, uploads the second relay SRL packet to the internal network receiving agent, and transmits a third relay SRL packet obtained by decreasing the counter value of the second relay SRL packet to the internal network Counter of the second relay SRL packet transmitted to the optical transmitter and not uploaded transmitting a third relay SRL packet with a reduced value to the internal network transmission optical transmitter; and, after the internal network optical transmission device decrements the counter value of the third relay SRL packet, to the internal network transmission agent including uploading.

According to the present invention, after the internal network transmission optical transmitter decreases the counter value of the third relay SRL packet and uploads it to the internal network transmission agent, the internal network transmission agent transmits the security policy distribution SRL packet to the security It may further include the step of transmitting to the server.

In the present invention, the internal network transmission optical transmission device, external network reception optical transmission device, external network transmission optical transmission device, and internal network reception optical transmission device are connected by an optical transmission line having a ring flow path of a one-way circulation structure. , it is possible to transmit the SRL packet in one direction through the optical transmission line.

In the present invention, the step of generating a security policy distribution SRL packet by the internal network transmission optical transmission device of the internal network transmission control server and transmitting it to the external network reception control server comprises: the one-way optical transmission unit of the internal network transmission optical transmission device; Generating the security policy distribution SRL packet consisting of a header and security policy data including a purpose (SRL_FLAG), a counter (SRL_CNT) for classifying the number of relays to a destination, and a control server identifier (Upload_ID); and transmitting, by the one-way optical receiver of the transmitter, the security policy distribution SRL packet to the external network receiver optical transmitter through the optical transmission line.

In the present invention, in the step of transmitting the first relay SRL packet to the external network transmission control server, the unidirectional optical receiver of the external network reception optical transmission device determines whether to upload the security policy distribution SRL packet through the control server identifier of the packet. judging, if the determination result is an upload target, the one-way optical receiver of the external network receiving optical transmitter transmits the security policy data of the security policy distribution SRL packet to the external network receiving agent through the one-way optical transmitter of the external network receiving optical transmitter and transmits the first relay SRL packet in which the counter value of the security policy distribution SRL packet is reduced to the one-way optical transmitter of the external network reception optical transmitter, and if not for upload, the counter of the security policy distribution SRL packet transmitting a first relay SRL packet with a reduced value to a unidirectional optical transmitter of the external network reception optical transmitter, wherein the unidirectional optical transmitter of the external network reception optical transmitter transmits the first relay SRL packet to an optical transmission line It may include the step of transmitting to the external network transmission optical transmission device through the.

In the present invention, when the one-way optical receiver of the external network reception optical transmitter uploads the security policy data to the external network reception agent, the external network reception agent applies the security policy data; The unidirectional optical transmitter of the transmitter generates a security policy application response SRL packet consisting of a header and security policy response data including a purpose (SRL_FLAG), a counter (SRL_CNT) that distinguishes the number of relays to the destination, and a control server identifier (Upload_ID). and transmitting the response SRL packet to a unidirectional optical receiver of the external network transmission optical transmitter through the optical transmission line.

In the present invention, after transmitting the response SRL packet to the unidirectional optical receiver of the external network transmission optical transmitter through the optical transmission line, the unidirectional optical receiver of the external network transmission optical transmission device counters the response SRL packet. generating a first response relay SRL packet with a reduced value; transmitting, by a unidirectional optical transmitter of the external network transmission optical transmitter, the first response relay SRL packet to a unidirectional optical receiver of the external network reception optical transmitter , generating, by the unidirectional optical receiver of the external network reception optical transmitter, a second response relay SRL packet in which a counter value of the first relay response SRL packet is decreased, by the unidirectional optical transmitter of the external network reception optical transmitter transmitting the second relay response SRL packet to a unidirectional optical receiver of the internal network reception optical transmitter, after the unidirectional optical receiver of the internal network reception optical transmitter decreases the counter value of the second relay response SRL packet The method may further include uploading the security policy response data to the internal network transmission agent, and transmitting, by the internal network transmission agent, the security policy response data to the security server.

In the present invention, the step of transmitting the second relay SRL packet to the internal network reception control server includes: the one-way optical receiver of the external network transmission optical transmission device determines whether the upload target is an upload target through the control server identifier of the first relay SRL packet. determining; if the determination result is the upload target, the one-way optical receiver of the external network transmission optical transmitter transmits the security policy data of the first relay SRL packet to the external network transmission agent through the one-way optical transmitter of the external network optical transmitter The second relay SRL packet that is uploaded to 410 and reduced the counter value of the first relay SRL packet is transmitted to the one-way optical transmitter of the external network transmission optical transmitter. transmitting a second relay SRL packet with a reduced packet counter value to a unidirectional optical transmitter of the external network transmission optical transmitter, wherein the unidirectional optical transmitter of the external network optical transmission device optically transmits the second relay SRL packet It may include transmitting to the internal network reception optical transmitter through a line.

In the present invention, when the one-way optical receiver of the external network transmission optical transmission device uploads the security policy data to the external network transmission agent, the external network transmission agent applying the security policy data; The unidirectional optical transmitter of the transmitter generates a security policy application response SRL packet consisting of a header and security policy response data including a purpose (SRL_FLAG), a counter (SRL_CNT) that distinguishes the number of relays to the destination, and a control server identifier (Upload_ID). and transmitting the response SRL packet to a unidirectional optical receiver of the internal network reception optical transmitter through the optical transmission line.

In the present invention, after the step of transmitting the response SRL packet to the unidirectional optical receiver of the internal network reception optical transmitter through the optical transmission line, the unidirectional optical receiver of the internal network reception optical transmitter receives the counter value of the response SRL packet The method may further include uploading the security policy response data to the internal network transmission agent after reducing , and transmitting, by the internal network transmission agent, the security policy response data to the security server.

According to the present invention, stream data can be transmitted while maintaining unidirectional characteristics by using a pair of data diodes in different directions (forward and reverse).

In addition, according to the present invention, in order to ensure the integrity of the SRL packet for security policy delivery (Delivery_confirm) in the SRL communication path having a ring circulation flow connected in one direction, the transmission control server of the security area becomes the starting point and the final destination. By doing so, it can be checked whether the security policy transmission is normally delivered to each control server through the one-way ring circulation path, and it is possible to prevent forgery*?

On the other hand, the effects of the present invention are not limited to the above-mentioned effects, and various effects may be included within the range apparent to those skilled in the art from the contents to be described below.

1 is a diagram illustrating a heterogeneous inter-network communication system using unidirectional communication according to an embodiment of the present invention.
2 is a block diagram schematically showing the configuration of an optical transmission device according to an embodiment of the present invention.
3 is a diagram for explaining an SRL packet according to an embodiment of the present invention.
4 is a view for explaining a security policy distribution and management method using the SRL protocol according to an embodiment of the present invention.
5 is a diagram for explaining a method for security policy distribution and relay according to an embodiment of the present invention.
6 is a diagram for explaining an SRL packet for security policy distribution and relay according to an embodiment of the present invention.
7 is a diagram for explaining SRL communication for transmitting a response message according to application of a security policy according to an embodiment of the present invention.
8 is a diagram for explaining a response SRL packet according to application of a security policy according to an embodiment of the present invention.

Hereinafter, a heterogeneous inter-network communication system and method using unidirectional communication according to an embodiment of the present invention will be described with reference to the accompanying drawings. In this process, the thickness of the lines or the size of the components shown in the drawings may be exaggerated for clarity and convenience of explanation.

In addition, the terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to the intention or custom of the user or operator. Therefore, definitions of these terms should be made based on the content throughout this specification.

Further, implementations described herein may be implemented as, for example, a method or process, an apparatus, a software program, a data stream, or a signal. Although discussed only in the context of a single form of implementation (eg, only as a method), implementations of the discussed features may also be implemented in other forms (eg, in an apparatus or a program). The apparatus may be implemented in suitable hardware, software and firmware, and the like. A method may be implemented in an apparatus such as, for example, a processor, which generally refers to a computer, a microprocessor, a processing device, including an integrated circuit or programmable logic device, or the like. Processors also include communication devices such as computers, cell phones, portable/personal digital assistants ("PDAs") and other devices that facilitate communication of information between end-users.

1 is a diagram illustrating a heterogeneous inter-network communication system using unidirectional communication according to an embodiment of the present invention.

Referring to FIG. 1 , an inter-network communication system 100 using one-way communication according to an embodiment of the present invention includes an internal network transmission control server 200 , an external network reception control server 300 , and an external network transmission control server 400 . ) and an internal network reception control server 500 , which may be connected by an optical transmission line 600 having a ring flow path of a one-way circulation structure. In addition, the inter-network communication system using one-way communication may be located between the internal network (security area) 700 and the external network (non-security area) 800 .

The internal network 700 may include internal network systems, and the external network 800 may include external network systems. The internal network systems are systems connected through the internal network 700 , and may be the same system or different systems. For example, the internal network system may include a security server, a log server, and the like. External network systems are systems connected through the external network 800 , and may be the same system or different systems. For example, the external network system may include OPC-UA or the like.

The internal network transmission control server 200 is connected to the internal network, receives data from the internal network host, and transmits the received data to the external network reception control server 300 through the optical transmission line 600 .

The internal network transmission control server 200 includes an internal network transmission agent 210 and an internal network transmission optical transmission device 220 .

The internal network transmission agent 210 transmits the data received from the internal network host to the application or internal network transmission optical transmission device 220 . In addition, the internal network transmission agent 210 informs whether the received data (eg, security policy) is normally applied, or a control command such as an error or loss detection or retransmission request for data transmitted between transmission and reception control server proxies can be sent to the secure server.

The internal network transmission optical transmission device 220 generates data received from the internal network transmission agent 210 into SRL (Secure Ring Link) packets, and transmits the SRL packets to the external network reception control server ( 300) is sent.

The internal network transmission optical transmission device 220 transmits the optical transmission channel to the one-way optical transmission unit 920 so that the linked security policy can be safely transmitted to other control servers so that the administrator can control the business data in the internal network (security area). and a unidirectional light receiver. Therefore, the internal network transmission optical transmitter 220 uses the unidirectional optical transmitter 920 and the unidirectional optical receiver to have a one-way cyclic ring flow using the incompatible Secure Ring Link (SRL). A security policy can be relayed to other control servers using data frames (ie, SRL packets). Here, the SRL packet is composed of a header and data including a purpose (SRL_FLAG), a counter (SRL_CNT) that distinguishes the number of relays to a destination, and a control server identifier (Upload_ID), and a detailed description will be described in FIG. 3 .

The external network reception control server 300 is connected to the external network 800, receives data from the internal network transmission control server 200, and transmits the received data to the external network transmission control server ( 400) is sent.

The external network reception control server 300 includes an external network reception agent 310 and an external network reception optical transmission device 320 .

The external network reception agent 310 applies the SRL packet transmitted from the external network reception optical transmitter 320 . In addition, the external network reception agent 310 informs whether the received data (eg, a security policy) is normally applied, or a control command such as an error or loss detection or retransmission request for data transmitted between transmission and reception control server proxies can be sent to the secure server.

The external network reception optical transmitter 320 analyzes the SRL packet received from the internal network transmission control server 200, and transmits the SRL packet to the external network reception agent 310 or external network transmission control server according to the analysis result. (400).

The external network reception optical transmission device 320 transmits an optical transmission channel to the one-way optical transmission unit 920 to safely transmit the linked security policy to other control servers so that the administrator can control business data in the internal network (security area). and a unidirectional light receiver. Therefore, the external network reception optical transmitter 320 uses the one-way optical transmitter 920 and the one-way optical receiver to have a one-way cyclic ring flow using a non-compatible security policy transfer protocol (SRL, Secure Ring Link). A security policy can be relayed to other control servers using data frames (ie, SRL packets).

The external network transmission control server 400 is connected to the external network 800, receives data from the external network reception control server 300, and transmits the received data to the internal network reception control server ( 500) is sent.

The external network transmission control server 400 includes an external network transmission agent 410 and an external network transmission optical transmission device 420 .

The external network transmission agent 410 applies the data transmitted from the external network transmission optical transmission device 420 . In addition, the external network transmission agent 410 informs whether the received data (eg, security policy) is normally applied, or a control command such as an error or loss detection or retransmission request for data transmitted between transmission and reception control server proxies can be sent to the secure server.

The external network transmission optical transmitter 420 analyzes the SRL packet received from the external network reception control server 300, and transmits the SRL packet to the external network reception agent 310 or the internal network reception control server according to the analysis result. (500).

The external network transmission optical transmission device 420 transmits the optical transmission channel to the internal network (security area) 700 so that the administrator can control the business data and safely transmit the linked security policy to other control servers. It may have a structure separated into 920 and a unidirectional light receiving unit. Accordingly, the external network transmission optical transmitter 420 uses the one-way optical transmitter 920 and the one-way optical receiver to have a one-way cyclic ring flow using the incompatible secure policy delivery protocol (SRL, Secure Ring Link). A security policy can be relayed to other control servers using data frames (ie, SRL packets).

The internal network reception control server 500 is connected to the internal network 700, receives data from the external network transmission control server 400, and transmits the received data to the internal network transmission control server ( 200) is sent.

The internal network reception control server 500 includes an internal network reception agent 510 and an internal network reception optical transmission device 520 .

The internal network reception agent 510 applies data transmitted from the internal network reception optical transmission device 520 . In addition, the internal network reception agent 510 informs whether the received data (eg, security policy) is normally applied, or controls commands such as error or loss detection or retransmission request for data transmitted between transmission and reception control server proxies. can be sent to the secure server.

The internal network reception optical transmitter 520 analyzes the SRL packet received from the external network transmission control server 400, and transmits the SRL packet to the internal network reception agent 510 or internal network transmission optical transmission according to the analysis result. sent to device 220 .

The internal network reception optical transmitter 520 transmits the optical transmission channel to the one-way optical transmitter so that the security policy linked to the internal network (security area) 700 can be safely transmitted to other control servers so that the administrator can control the business data. It may have a structure separated into 920 and a unidirectional light receiving unit. Therefore, the internal network reception optical transmitter 520 uses the one-way optical transmitter 920 and the one-way optical receiver to have a one-way cyclic ring flow using a non-compatible secure policy delivery protocol (SRL, Secure Ring Link). A security policy can be relayed to other control servers using data frames (ie, SRL packets).

The optical transmission line 600 has a ring flow path of a one-way circulation structure required for data (eg, security policy) transmission, and includes an internal network transmission control server 200 , an external network reception control server 300 , and an external network. A diode is connected in one direction so that data is transmitted in the order of the network transmission control server 400 and the internal network reception control server 500 .

2 is a block diagram schematically showing the configuration of an optical transmission apparatus according to an embodiment of the present invention, and FIG. 3 is a diagram for explaining an SRL packet according to an embodiment of the present invention.

Referring to FIG. 2 , an optical transmitter 900 according to an embodiment of the present invention includes an interface unit 910 , a unidirectional light transmitter 920 , and a unidirectional light receiver 930 .

The interface unit 910 may be configured for communication with an agent.

The unidirectional optical transmitter 920 transmits an SRL packet to another control server. The unidirectional optical transmitter 920 includes a multiplexer 922 , an encoding part 924 , and a transmitter 926 .

The multiplexer 922 multiplexes SRL packets for data distribution and relay.

The encoding unit 924 encodes the SRL packet multiplexed by the multiplexing unit 922 .

The transmitter 926 transmits the SRL packet encoded by the encoder 922 to the optical transmission line 600 .

The unidirectional light receiving unit 930 is configured to receive an SRL packet from another control server, and includes a receiving unit 932 , a decoding unit 934 , and a received packet processing unit 936 .

The receiver 932 receives the SRL packet through the optical transmission line 600 .

The decoding unit 934 decodes the SRL packet received by the receiving unit 932 .

The received packet processing unit 936 determines whether the control server identifier of the SRL packet decoded by the decoding unit 934 has a value corresponding to it, and if it is a value corresponding to itself, the SRL packet is transmitted to the agent through the interface unit 910. After uploading, the counter value of the SRL packet is decremented if the value is not corresponding to the value, and then transmitted to the multiplexing unit 922 of the unidirectional optical transmitter 920 .

The security policy reception and relay path of the optical transmission device 900 can provide an independent circular ring flow without external interference through a reception packet processing unit made of hardware, so that it is impossible to forge/modify the security policy due to external hacking. have. The SRL packet for distribution and relay of security policies according to the configuration of the optical transmission device made of hardware may have a structure as shown in FIG. 3 .

Referring to FIG. 3 , an SRL packet (SRL datagram packet) consists of an SRL header and data including a purpose (SRL_FLAG), a counter (SRL_CNT) that distinguishes the number of relays to a destination, and a control server identifier (Upload_ID).

The components of the SRL packet header may be as shown in Table 1 below.

'SRL_FLAG' is a delimiter according to the purpose of the SRL packet as shown in Table 1, and may be expressed with two bits, as shown in Table 2 below.

In particular, in the case of an SRL packet that delivers a security policy, 'SRL_CNT' may use a counter that identifies the number of times the SRL packet is relayed as shown in Table 1. At this time, based on the internal network transmission control server 200 that is initially transmitted, the destination to be finally reached is expressed as two bits for the purpose of determining the internal network transmission control server 200 again, and may be as shown in Table 3 below.

If the value obtained by reducing the 'SRL_CNT' value of the received SRL packet by -1 is '0', the reception packet processing unit 936 of the unidirectional optical receiver 930 does not transmit the unidirectional optical transmitter to the multiplexer for relay transmission anymore. It is transmitted to the interface unit 910 (PCIe) for upload to the agent (Ag_m), and if the value is not '0', the value reduced by -1 is changed to the 'SRL_CNT' value, and then the packet is transmitted to the one-way optical transmitter 920. It is transmitted to the multiplexer 910 . In particular, when the security policy is distributed from the security server existing in the internal network (security area) 700 to each control server, the value of 'SRL_CNT' of the SRL packet generated by the internal network transmission control server 200 is set to '4'. In order to ensure the integrity of the SRL packet for security policy delivery (Delivery_confirm) in the SRL communication path having a ring circulation flow connected in one direction by setting, the internal network transmission control server 200 can be the starting point and the final destination. . In this way, it is possible to check whether the security policy transmission is normally delivered to each control server through the one-way ring circulation path, and it is possible to prevent forgery*?* modification of security policies from other control servers without security setting authority.

As shown in Table 1, 'Upload_ID' designates a single or multiple control server to be uploaded to the agent (Ag_m) through the interface unit 910 (PCIe) of the SRL packet received by each control server as shown in Table 1. A value can be expressed as 4 bits.

'Upload_ID' may have, for example, the form shown in Table 4 below.

4 is a view for explaining a security policy distribution and management method using the SRL protocol according to an embodiment of the present invention.

Referring to FIG. 4, the security area is divided into internal and the non-security area is defined as external, and the security server 710 of the security area and the internal network transmission control server 200 are iTx, and the outside of the non-security area. The network reception control server 300 may be expressed as eRx, the external network transmission control server 400 of the non-secure area may be expressed as eTx, and the internal network reception control server 500 of the secure area may be expressed as iRx, respectively. In addition, each transmission control server and reception control server may have a 1:1 pairing structure using a data diode type one-way optical SFP optical module.

The agent (Ag_m) 210 of the internal network transmission control server (iTx) 200 receives the security policies (①,②,③,④,⑤,⑥,⑦,⑧,⑨,⑩, When ⑪,⑫) is received, the security policy corresponding to iTx(200) is applied among the received security policies (①,②,③,④,⑤,⑥,⑦,⑧,⑨,⑩,⑪,⑫). (①,②,③) do,

Then, the internal network transmission optical transmission device 220 of the internal network transmission control server 200 transmits the security policy of the other control server received through the linkage middleware through the incompatible transmission protocol SRL (Secure Ring Link) (④) ,⑤,⑥,⑦,⑧,⑨,⑩,⑪,⑫).

Then, the internal network transmission optical transmission device 220 transmits the security policy delivered through the SRL protocol to the external network reception optical transmission device 320 of the external network reception control server 300 (④,⑤,⑥,⑦, ⑧, ⑨, ⑩, ⑪, ⑫).

The external network reception optical transmitter 320 deframes the security policy frame received through the one-way optical receiver (PHY RX) and relays it to the one-way optical transmitter (PHY TX) (⑦,⑧,⑨,⑩,⑪,⑫). ) or to the interface unit to transmit to the agent 310 to apply the security policy (④, ⑤, ⑥). In this case, the agent 310 may apply the security policy received from the interface unit 910 (④, ⑤, ⑥).

When relayed to the one-way optical transmitter (PHY TX) of the external network reception optical transmitter 320, the one-way optical transmitter (PHY TX) of the external network reception optical transmitter 320 is the one-way of the external network transmission optical transmitter 420 The security policy is transmitted (⑦,⑧,⑨,⑩,⑪,⑫) to the optical receiver (PHY RX).

Then, the external network transmission optical transmitter 420 deframes the security policy frame received through the one-way optical receiver (PHY RX) and relays it to the one-way optical transmitter (PHY TX) (⑩, ⑪, ⑫) or security policy In order to apply to the agent 410, it is transferred to the interface unit (⑦, ⑧, ⑨). At this time, the agent 410 may apply the security policy received from the interface unit (⑦, ⑧, ⑨).

When relayed to the one-way optical transmission unit (PHY TX) of the external network transmission optical transmission device 420, the one-way optical transmission unit (PHY TX) of the external network transmission optical transmission device 420 is the internal network reception control server 500 (iRx) The security policy is transmitted (⑩, ⑪, ⑫) to the one-way optical receiver (PHY RX) of

Then, the one-way optical receiver (PHY RX) of the internal network reception control server 500 completes (⑩, ⑪, ⑫) delivery of the security policy to the agent 510 .

Then, the internal network reception optical transmitter 520 checks the final policy distribution of the security server 710 through the iTx 200 as the final source and destination through the SRL protocol.

5 is a diagram for explaining a method for security policy distribution and relay according to an embodiment of the present invention, FIG. 6 is a diagram for explaining an SRL packet for security policy distribution and relay according to an embodiment of the present invention am.

5 and 6, when the agent 210 of the internal network transmission control server 200 receives a command set (command + policy data) from the security server 710, the internal network transmission control server 200 unidirectional The optical transmitter 222 generates an SRL packet (Delivery_Confirm(eTx)) for command control as shown in FIG. 6 , and transmits the generated SRL packet to the one-way optical receiver 324 of the external network reception control server 300 .

Since the unidirectional optical receiver 324 of the external network reception control server 300 does not match the 'Upload_ID' value of the SRL packet header with its corresponding value '0100' (eRx), the SRL packet is transmitted to the agent 310 through PCI. ), and the 'SRL_CNT' value of the SRL packet that is reduced by -1 from the 'SRL_CNT' value is changed to '3' (bit notation '10'). 320) through the one-way optical transmission unit 322 to transmit to the external network transmission control server (400).

The unidirectional optical receiver 424 of the external network transmission optical transmitter 420 in the external network transmission control server 400 (eTx) receives the 'Upload_ID'b header of the SLR packet (counter '3') received from the eRx 300 . Since the value matches its corresponding value of '0010' (eRx), the corresponding SRL packet is uploaded to the PCIe for transmission to the agent 410 . At this time, the receiving packet processing unit of the eTx (400) transmits the relay SRL packet changed from the 'SRL_CNT' value to the -1 counter value '2' (bit notation '01') in parallel with the upload to the PCIe internal network reception control server. (500) (iRx).

The internal network reception optical transmitter 520 of the iRx 500 matches the 'Upload_ID' value of the relay SLR packet (counter '2') transmitted from the eTx 400 to its corresponding value '0010' (iRx) Therefore, the corresponding SRL packet is not uploaded to the agent 510 through PCI, and the relay SRL packet that has the counter value decreased by -1 from the 'SRL_CNT' value is changed to '1' (bit notation '00') is sent back to iTx( 200) is sent.

The unidirectional optical receiver 224 of the iTx 200 decreases the 'SRL_CNT' counter value by -1 from the 'SRL_CNT' counter value of the SLR packet (counter '1') delivered from the iRx 500 to '0'. and relay transmission through the one-way SRL communication path for relaying is not performed.

The agent 210 of the iTx 200 transmits the 'Deliver_Confirm' received through PCIe, that is, the security policy distribution command set back to the security server 710 . Through this, the security server 710 confirms that the corresponding security policy distribution command has been delivered to the target control server, and stores the related log.

7 is a view for explaining SRL communication for transmitting a response message according to application of a security policy according to an embodiment of the present invention, and FIG. 8 is a diagram for explaining a response SRL packet according to application of a security policy according to an embodiment of the present invention It is a drawing for

7 and 8 , the agent 410 of the eTx 400 generates an SRL packet for 'SetValue_Confirm(eTx)' as shown in FIG. 8 after applying the received security policy. At this time, the SRL packet (counter '2') of the eTx 400 is transmitted to the iRx 500 through the unidirectional optical transmitter 422 of the external network transmission optical transmitter 420 .

Since the unidirectional optical receiver 524 of the internal network reception control server (iRx) 500 does not match the 'Upload_ID' value of the SRL packet header with its corresponding value '0001' (iRx), the SRL packet is transmitted through PCIe. It is not uploaded to the agent 510, and the relay response SRL packet in which the counter 'SRL_CNT' value, which is decreased by -1 from the 'SRL_CNT' value, is changed to '1' (bit notation '00') is transmitted through the one-way optical transmitter 522 It is transmitted to the internal network transmission control server (iTx) (200).

The unidirectional light receiver 224 of the iTx 200 decreases the counter value by -1 from the 'SRL_CNT' value of the relay response SLR packet (counter '1') received from the iRx 500 becomes '0'. It only uploads to the agent 210, and does not retransmit through the relay one-way SRL communication path.

The agent 210 of the iTx 200 transmits the received 'SetValue_Confirm' data, that is, a security policy processing response message to the security server 710 . Through this, the security server 710 can confirm that the corresponding security policy has been normally applied to the eTx and store the related log.

As described above, in the heterogeneous network communication system and method using unidirectional communication according to the present invention, stream data can be transmitted while maintaining unidirectional characteristics by using pairs of data diodes in different directions (forward and reverse).

In addition, the heterogeneous inter-network communication system and method using unidirectional communication according to the present invention is a security area for ensuring the integrity of an SRL packet for security policy delivery (Delivery_confirm) in an SRL communication path having a ring circulation flow connected in one direction. By making the transmission control server of the transmission control server as the starting point and the final destination, it is possible to check whether the transmission of the security policy is normally transmitted to each control server through the one-way ring circulation path, and it is possible to confirm that the security policy is ?* can be prevented from being tampered with.

Although the present invention has been described with reference to the embodiment shown in the drawings, this is merely exemplary, and it is understood that various modifications and equivalent other embodiments are possible by those of ordinary skill in the art. will understand Therefore, the true technical protection scope of the present invention should be defined by the following claims.

200: internal network transmission control server
300: external network reception control server
400: external network transmission control server
500: internal network reception control server
600: optical transmission line
700: internal network
800: external network

Claims (17)

an optical transmission line having a ring flow path of a one-way circulation structure;
an internal network transmission control server connected to the internal network, receiving data from an internal network host, and transmitting the received data to an external network reception control server through the optical transmission line;
an external network reception control server connected to an external network, receiving data from the internal network transmission control server, and transmitting the received data to an external network transmission control server through the optical transmission line;
an external network transmission control server connected to the external network, receiving data from the external network reception control server, and transmitting the received data through the optical transmission line; and
An internal network reception control server connected to the internal network, receiving data from the external network transmission control server, and transmitting the received data to the internal network transmission control server through the optical transmission line,
The optical transmission line is
A diode is connected in one direction to transmit data in the order of the internal network transmission control server, external network reception control server, external network transmission control server, and internal network reception control server,
The internal network transmission control server,
an internal network transmission agent for transmitting the data received from the internal network host to an application or internal network transmission optical transmission device; and
and an internal network transmission optical transmission device for generating data received from the internal network transmission agent into SRL (Secure Ring Link) packets, and transmitting the SRL packet to the external network reception control server through the optical transmission line,
The external network reception control server,
An external network reception light that analyzes the SRL packet received from the internal network transmission control server and transmits the SRL packet to an external network reception agent or to the external network transmission control server through the optical transmission line according to the analysis result transmission device; and
and an external network reception agent that applies the SRL packet transmitted from the external network reception optical transmitter;
The external network transmission control server,
An external network transmission optical that analyzes the SRL packet received from the external network reception control server and transmits the SRL packet to an external network transmission agent or to the internal network reception control server through the optical transmission line according to the analysis result transmission device; and
and an external network reception agent that applies data transmitted from the external network transmission optical transmission device,
The internal network reception control server,
Internal network reception that analyzes the SRL packet received from the external network transmission control server and transmits the SRL packet to the internal network reception agent or the internal network transmission optical transmitter through the optical transmission line according to the analysis result optical transmission device; and
and an internal network reception agent that applies the data transmitted from the internal network reception optical transmitter.
delete According to claim 1,
The SRL packet is
A heterogeneous inter-network communication system using one-way communication, characterized in that it consists of a header and data including a purpose (SRL_FLAG), a counter (SRL_CNT) that distinguishes the number of relays to a destination, and a control server identifier (Upload_ID).
4. The method of claim 3,
each of the internal network transmission optical transmission device, the external network reception optical transmission device, the external network transmission optical transmission device and the internal network reception optical transmission device,
an interface unit for communication with the agent;
a unidirectional optical transmitter for transmitting SRL packets to another control server; and
A heterogeneous network communication system using one-way communication, characterized in that it includes a one-way optical receiver for receiving an SRL packet from another control server.
5. The method of claim 4,
The unidirectional light transmitter,
a multiplexer for multiplexing SRL packets for distribution and relay of the data;
an encoding unit for encoding the multiplexed SRL packet; and
and a transmitter for transmitting the encoded SRL packet to the optical transmission line.
6. The method of claim 5,
The unidirectional light receiving unit,
a receiver for receiving an SRL packet through the optical transmission line;
a decoding unit for decoding the received SRL packet; and
Determines whether the control server identifier of the decoded SRL packet is a value corresponding to itself, uploads the SRL packet to the agent through the interface unit if it is a value corresponding to itself, and if it is not a value corresponding to itself, the value of the counter and a received packet processing unit for transmitting the received packet to the multiplexing unit of the unidirectional optical transmission unit after reducing .
According to claim 1,
The optical transmission line is
A heterogeneous manganese communication system using unidirectional communication, characterized in that it is formed on diodes in different directions.
A method for transmitting a security policy in a heterogeneous network communication system using one-way communication including an internal network transmission control server, an external network reception control server, an external network transmission control server, and an internal network reception control server, the method comprising:
When the internal network transmission agent of the internal network transmission control server receives a security policy distribution command from the internal network security server, the internal network optical transmission device of the internal network transmission control server generates a security policy distribution SRL packet to receive the external network transmitting to the control server;
The external network reception optical transmitter of the external network reception control server analyzes the security policy distribution SRL packet to determine whether it is an upload target, and if it is an upload target, uploads the SRL packet to an external network reception agent, and a counter of the SRL packet transmitting a first relay SRL packet with a reduced value to the external network transmission control server, and transmitting a first relay SRL packet with a reduced value of the counter value of the SRL packet to the external network transmission control server if it is not an upload target; ;
The external network transmission optical transmission device of the external network transmission control server analyzes the first relay SRL packet to determine whether it is an upload target, and if it is an upload target, uploads the first relay SRL packet to the external network transmission agent, wherein the first relay SRL packet is uploaded to the external network transmission agent. A second relay SRL packet in which the counter value of the first relay SRL packet is decreased is transmitted to the internal network reception control server, and if it is not an upload target, the second relay SRL packet in which the counter value of the first relay SRL packet is decreased is transmitted to the transmitting to an internal network reception control server;
The internal network reception optical transmission device of the internal network reception control server analyzes the second relay SRL packet to determine whether it is an upload target, and if it is an upload target, uploads the second relay SRL packet to the internal network reception agent. 2 A third relay SRL packet with a reduced counter value of the relay SRL packet is transmitted to the internal network transmission optical transmitter, and if it is not an upload target, a third relay SRL packet with a reduced counter value of the second relay SRL packet is transmitted transmitting to the internal network transmission optical transmission device; and
and uploading, by the internal network transmission optical transmission device, to the internal network transmission agent after decrementing the counter value of the third relay SRL packet.
A heterogeneous network communication method using one-way communication comprising a.
delete delete delete delete delete delete delete delete delete

Images