TW201931833A - System and method for unidirectional transfer of file - Google Patents

Abstract

A system for unidirectional transfer of files between a sender network and a receiver network is provided. The system includes a data diode configured to provide a one-way link between the sender network and the receiver network. The data diode includes a data diode sender and a data diode receiver wherein the data diode receiver is communicably coupled to the data diode sender for unidirectional transfer of files from the data diode sender to the data diode receiver. Each file is identified using a file identifier. The data diode sender is configured to send a file list to the data diode receiver. The file list includes file identifiers of all the files to be sent through the data diode. The data diode receiver is configured to detect a loss of one or more files based on comparing the file identifiers of received files with the file identifiers present in the file list.

Description

Detection of lost files in one-way file transfer system

This disclosure is about a one-way file transfer system. More specifically, this disclosure is about detecting file loss in a one-way file transfer system.

One-way file transfer systems are often used to mitigate the security risks of connecting two different networks. In one embodiment, a one-way transfer is performed on the physical layer using a data diode. Allowing files to be transferred in only one direction provides network security to the network by isolating it from potential security holes (such as unwanted and unauthorized data flowing out of the network), while still allowing the network to Road can transfer files in a controlled manner. Generally, the files to be transferred are sent from the data diode transmitter in the transmitter network to the data diode receiver in the receiver network. Loss of files may occur during the transfer of files. For example, file loss can occur when a data diode receiver cannot keep up with files from a data diode transmitter.

Because there is no feedback loop in the one-way file transfer system, the data diode transmitter is unaware of the missing files. As a result, users of the one-way file transfer system will not know if the files are missing (if they exist) unless it has been physically verified that all files have been successfully received at the data diode receiver. Most known solutions to file loss issues include feedback mechanisms to notify the data diode sender or some other component in the sender network that the file is missing. In addition, corrective actions such as initiating retransmissions of lost files also use feedback mechanisms. An example of file loss detection and repair using a feedback mechanism is disclosed in US Patent 9,264,470.

Therefore, there is a need for a one-way file transfer system designed to detect lost files in a fast and simple manner.

In an aspect of the present invention, a system for unidirectionally transferring files between a sender network and a receiver network is provided. The system includes a data diode configured to provide a unidirectional link between a transmitter network and a receiver network.

The data diode includes a data diode transmitter and a data diode receiver. The data diode receiver is communicatively coupled to the data diode transmitter for unidirectionally transferring files from the data diode transmitter to the data diode receiver. Each file is identified using a file identifier such as a file name or file number.

The data diode transmitter is further configured to send a file list to the data diode receiver. The file list includes file identifiers of all files to be sent via the data diode. The data diode receiver is configured to detect the loss of one or more files based on comparing the file identifier of the received file with the file identifier existing in the file list.

In an aspect of the invention, the data diode transmitter is configured to repeatedly send the archive list to the data diode receiver. For example, the data diode transmitter may send the archive list a predetermined number of times. Alternatively, the data diode transmitter may periodically send the file list to the data diode receiver.

In an aspect of the present invention, when the loss of the one or more files is detected, the data diode receiver is configured to generate the file containing the lost one or more files. Identifier log.

In another aspect of the present invention, when the loss of the one or more files is detected, the data diode receiver is configured to generate an indication of the loss of the one or more files. Alert message. The alert message includes the file identifier of the one or more files that were lost during the transfer of the files from the data diode transmitter to the data diode receiver. The alert message is transmitted to a user device or a monitoring unit communicatively coupled to the data diode using a Simple Mail Transfer Protocol (SMTP) or a system log (Syslog).

In another aspect of the present invention, the alert message is for triggering a response to the one or more of the files lost during the transfer of the file from the data diode transmitter to the data diode receiver. Resend the file. The retransmission of the one or more files is triggered using the file identifier of the one or more files.

Other features and aspects of the present invention will be apparent from the following description and drawings.

Wherever possible, the same reference numbers will be used throughout the drawings to refer to the same or similar parts. In addition, where more than one element of the same type may be present, references to various elements described herein are made collectively or individually. However, such references are merely exemplary in nature. It may be noted that unless explicitly stated in the scope of the accompanying patent application, any reference to an element in the singular can be interpreted as being related to the plural, and vice versa, without limiting the scope of the invention to the exact number or type Of such components.

FIG. 1 schematically illustrates an example of a one-way file transfer system 100 including a data diode 102 according to an embodiment of the present invention. For example, it provides communication between the transmitter network 104 and the receiver network 106, but also envisages additional networks. The sender network 104 may include one or more network traffic sources 108. The receiver network 106 may include one or more network traffic destinations 110. The data diode 102 is configured to enable one-way transfer of files between the transmitter network 104 and the receiver network 106. Specifically, the data diode 102 is configured to enable files to be transferred from the sender network 104 to the receiver network 106 and to prevent files from being transferred from the receiver network 106 to the sender network 104. Therefore, the data diode 102 acts as a transparent router that allows unidirectional transfer of files without modifying the data passing through it. Although the data diode 102 is shown in FIG. 1 as being external to the transmitter network 104 and the receiver network 106, one or more components of the data diode 102 may be disposed on the transmitter network 104 and And / or the receiver network 106.

In one embodiment, the file may contain various types of content, such as documents, images, web pages, graphics, video, sound, programs, and / or other formats. Although the invention has been explained using archives, the invention is equally applicable to other types of digital information or digital data known in the art.

FIG. 2 schematically illustrates exemplary components of a one-way archive transfer system 100 according to one embodiment of the present invention. The data diode 102 includes a data diode transmitter 202 and a data diode receiver 204. The data diode transmitter 202 is connected to the data diode receiver 204 via a unidirectional optical data link. This configuration physically implements one-way data transfer at both ends of the optical fiber that connects the data diode transmitter 202 to the data diode receiver 204, thereby generating data from the transmitter network 104 to the receiver network 106. A truly unidirectional unidirectional data link.

The data diode transmitter 202 is configured to send a plurality of files to the data diode receiver 204. In some scenarios, some files may be lost during the transfer from the data diode transmitter 202 to the data diode receiver 204. For example, the data diode receiver 204 may not be able to keep up with the file inflow from the data diode transmitter 202. To address this scenario, the data diode sender 202 is configured to send a file list that includes information about all files to be sent via the data diode 102. The file list may include one or more file identifiers, such as a file name, a file ID, a time stamp, and the like. FIG. 3 shows an example of a file list 302 including information of 50 files to be transmitted via the data diode 102. The file list 302 includes file names and file numbers as file identifiers.

In one embodiment, the data diode transmitter 202 is configured to compile a file list of the files as each file is transmitted from the data diode transmitter 202. The compilation of the archive list contains the history of all archives sent from the data diode sender 202 or the compilation of archives sent over a period of time.

In some cases, the file list may be lost in the transfer between the data diode transmitter 202 and the data diode receiver 204. To address this concern, the data diode transmitter 202 may be configured to repeatedly send the file list to the data diode receiver 204. In one embodiment, the data diode transmitter 202 is configured to send the archive list a predetermined number of times. In another embodiment, the data diode transmitter 202 is configured to periodically send the file list to the data diode receiver 204.

The data diode receiver 204 is configured to receive files transmitted by the data diode transmitter 202. The data diode receiver 204 may be configured to extract a file identifier of the received file. The data diode receiver 204 is also configured to receive a file list including file identifiers for all files to be transferred via the data diode 102. After completing the file transfer, the data diode receiver 204 is configured to detect whether one or more files are missing. Specifically, the data diode receiver 204 is configured to use the received file list to compare the file identifier of the received file with the file identifier present in the file list.

If some files are lost during the transfer between the data diode transmitter 202 and the data diode receiver 204, the data diode receiver 204 will be able to identify the missing files based on a comparison of the file identifiers. In other words, the missing file may be identified as a file in which the file identifier exists in the file list but is not received at the data diode receiver 204.

In one embodiment, the data diode receiver 204 is configured to generate a log containing information about the loss of one or more files. The log may include a file identifier of a file that is not received at the data diode receiver 204 but is listed in the file list. Optionally, the log may include time and date information and information related to the lost files.

In various embodiments, the data diode receiver 204 is configured to generate an alert message indicating the loss of one or more files. The alert message can be an email, text message, or any other alert message known in the art. The alert message may include the file identifier of one or more files that were lost during the transfer of the files from the data diode transmitter 202 to the data diode receiver 204. The alert message may be delivered to a user device or a remote monitoring unit communicatively coupled to the data diode 102. Alert messages can be delivered using Simple Mail Transfer Protocol (SMTP) or syslog or other alert protocols known in the art.

The alert message may be used to trigger the retransmission of one or more files that were lost during the transfer of the files from the data diode sender 202 to the data diode receiver 204. The retransmission of the lost file may be triggered using the file identifier of the lost file.

The various embodiments disclosed herein are to be understood in an illustrative and explanatory sense and should not be construed as limiting the scope of the invention. In addition, all numerical terms (such as, but not limited to, "primary", "secondary", "first", "second", "third" or any other general and / or numerical terms) shall also It is understood as an identifier to assist the reader in understanding various elements, embodiments, variations and / or modifications of the present invention, and may not generate any restrictions, especially for any element, embodiment, variation and / or modification relative to or compared to other Restrictions on the order or preference of an element, embodiment, variation, and / or modification.

It should be understood that individual features shown or described for one embodiment may be combined with individual features shown or described for another embodiment. The above embodiments do not limit the scope of the present invention in any way. It should therefore be understood that, although some features are shown or described in the context of a functional component to illustrate the use of the invention, it may be used without departing from the spirit of the invention as defined by the scope of the accompanying patent application The scope of the invention omits such features.

Industrial applicability

The embodiments of the present invention are applicable to the use and implementation of detecting lost files in the one-way file transfer system 100. The data diode 102 of the present invention is provided with a file list, which can be advantageously used to detect the loss of files during the transfer of files from the data diode sender 202 to the data diode receiver 204. In addition, compared with the traditional solution for detecting file loss in a one-way file transfer system, by using the embodiments disclosed herein, it is easy and fast to detect the file loss and further identify the file for retransmission.

FIG. 4 illustrates a method 400 for detecting the loss of one or more files during a unidirectional transfer of files from the sender network 104 to the receiver network 106. At step 402, the file list is received by the data diode receiver 204. The file list includes file identifiers of all files to be sent via the data diode 102. At step 404, the file sent by the data diode transmitter 202 is received by the data diode receiver 204. The data diode receiver 204 is configured to extract file identifiers of all files received by the data diode receiver 204.

At step 406, the data diode receiver 204 is configured to detect the loss of one or more files during the transfer of the files from the data diode transmitter 202 to the data diode receiver 204. The detection is performed based on comparing a file identifier of a received file with a file identifier existing in a file list. Therefore, using the one-way file transfer system 100 disclosed herein can save time, cost, and effort that are usually caused by manually detecting file loss or using other file loss detection techniques traditionally known in this technology.

Although the aspect of the present invention has been particularly shown and described with reference to the above embodiments, those skilled in the art will understand that without departing from the spirit and scope of the disclosure, it is possible to modify the disclosed machine, Systems and methods contemplate various additional embodiments. Such embodiments should be understood to fall within the scope of the present invention determined based on the scope of the patent application and any equivalents thereof.

100‧‧‧One-way file transfer system

102‧‧‧Data Diode

104‧‧‧Transmitter Network

106‧‧‧ Receiver Network

108‧‧‧ network traffic source

110‧‧‧ network traffic destination

202‧‧‧Data Diode Transmitter

204‧‧‧Data Diode Receiver

302‧‧‧File list

400‧‧‧Method

402, 404, 406‧‧‧ steps

FIG. 1 is a schematic diagram of a one-way file transfer system for unidirectionally transferring data from a sender network to a receiver network according to an embodiment of the present invention.

Figure 2 is a schematic representation of the components of a one-way archive transfer system according to an embodiment of the invention.

3 is an example of a file list sent from a data diode transmitter according to an embodiment of the present invention.

4 is a schematic flowchart of a method for unidirectionally transferring files from a sender network to a receiver network according to an embodiment of the present invention.

Claims (20)

A system for unidirectionally transferring files between a sender network and a receiver network, the system includes: A data diode configured to provide a unidirectional link between the transmitter network and the receiver network, the data diode comprising; Data diode transmitter; and Data diode receiver communicably coupled to the data diode transmitter for unidirectionally transferring files from the data diode transmitter to the data diode Volume receiver, where each file is identified using a file identifier; Wherein the data diode transmitter is configured to send a file list to the data diode receiver, the file list includes file identifiers of all files to be sent via the data diode, and the data diode The data diode receiver is configured to detect the loss of one or more files based on comparing the file identifier of the received file with the file identifier present in the file list. The system of claim 1, wherein the data diode transmitter is configured to send the archive list a predetermined number of times to the data diode receiver. The system according to item 2 of the patent application scope, wherein the data diode transmitter is configured to periodically send the archive list to the data diode receiver. The system according to item 1 of the scope of patent application, wherein the file identifier is at least one of a file name and a file number. The system of claim 1, wherein the data diode receiver is further configured to generate a file containing the one or more files when the loss of the one or more files is detected. A log describing the file identifier. The system of claim 1, wherein the data diode receiver is further configured to generate an address indicating the one or more files when the loss of the one or more files is detected. The missing alert message is described. The system of claim 6, wherein the alert message includes the one or more files that were lost during the transfer of files from the data diode transmitter to the data diode receiver The file identifier of. The system of claim 6, wherein the alert message is delivered to a user device or monitoring unit communicatively coupled to the data diode using a simple mail transfer protocol or a system log. The system according to item 6 of the patent application, wherein the alert message is used to trigger a response to the one that was lost during the transfer of files from the data diode transmitter to the data diode receiver. Or resend multiple files. The system of claim 7, wherein the retransmission of the one or more files is triggered using the file identifier of the one or more files. A method for unidirectionally transferring a file from a transmitter network to a receiver network using a data diode, the data diode includes a data diode transmitter and a data diode receiver, and the method includes : Receiving a file list by the data diode receiver, the file list including file identifiers of all files to be sent via the data diode; Receiving said file by said data diode receiver from said data diode transmitter on a unidirectional link; and Loss of one or more files is detected by the data diode receiver based on comparing the file identifier of the received file with the file identifier present in the file list. The method of claim 11, wherein receiving the archive list includes receiving the archive list a predetermined number of times. The method of claim 11, wherein receiving the archives list includes periodically receiving the archives list. The method according to item 11 of the patent application scope, wherein the file identifier is at least one of a file name and a file number. The method according to item 11 of the patent application scope further comprises generating a log containing the file identifier of the one or more files when the loss of the one or more files is detected. The method according to item 11 of the patent application scope further comprises generating an alarm message indicating the loss of the one or more files when the loss of the one or more files is detected. The method of claim 16, wherein the alert message includes the one or more files that were lost during the transfer of files from the data diode transmitter to the data diode receiver The file identifier of. The method of claim 16, wherein the alert message is delivered to a user device or a monitoring unit communicatively coupled to the data diode using a simple mail transfer protocol or a system log. The method according to item 16 of the patent application scope, wherein the alert message is used to trigger a response to the first Or resend multiple files. The method of claim 19, wherein the retransmission of the one or more files is triggered using the file identifier of the one or more files.