WO2015169120A1

WO2015169120A1 - Network access system, network protection device and terminal server

Info

Publication number: WO2015169120A1
Application number: PCT/CN2015/073552
Authority: WO
Inventors: 周宏斌
Original assignee: 周宏斌
Priority date: 2014-05-06
Filing date: 2015-03-03
Publication date: 2015-11-12
Also published as: CN104243442A

Abstract

Provided are a network access system, a network protection device and a terminal server. The network protection system comprises: at least one client in a local area network, a network protection device and a terminal server, wherein the client initiates a remote connection request to the terminal server, and sends locally acquired access operation data to the terminal server after receiving response information for the remote connection request; an internal processing apparatus in the network protection device transmits intranet data sent by the client to an intranet monitoring apparatus through a first transmission line, and sends the response information and extranet data transmitted by an external processing apparatus through a third transmission line to the client; and the intranet monitoring apparatus transmits the intranet data to the external processing apparatus through a second transmission line to transmit the intranet data to the terminal server through the external processing apparatus and access a network by the terminal server according to the intranet data, so as to improve the security for the local area network to access an extranet.

Description

Network access system, network protection device and terminal server

This application claims priority to Chinese Patent Application No. 201410190365.5, entitled "Network Access System, Network Protection Equipment, and Terminal Server" on May 6, 2014, the entire contents of which are incorporated by reference. In this application.

Technical field

The present application relates to the field of network technologies, and in particular, to a network access system, a network protection device, and a terminal server.

Background technique

A local area network is a group of computers that are interconnected by multiple computers in a certain area. In the LAN, the computer can perform data communication and realize data sharing. For example, some schools or units are internally a local area network.

With the development of network technology, communication between the local area network and the external Internet has been realized. In order to ensure the security of data resources inside the LAN, a firewall is set up between the LAN and the external Internet to reduce the risk of data resources being leaked or destroyed. However, once the Trojans, viruses, etc. in the external Internet break the firewall, the resources inside the LAN will face specific threats.

Summary of the invention

In view of this, the present application provides a network access system, a network protection device, and a terminal server to improve data security during an internal LAN access to an external network.

To achieve the above objective, the present application provides the following technical solution: a network access system, including: at least one client disposed in a local area network, a network protection device and a terminal server disposed between the local area network and an external network, The terminal server is connected to an external network;

The client is configured to initiate a remote connection request to the terminal server, and after receiving the response information of the terminal server for the remote connection request, send the locally acquired access operation data to the terminal server;

The network protection device includes: an internal processing device; an intranet monitoring device connected to the internal processing device through a first transmission line; and an external processing device connected to the intranet monitoring device through a second transmission line, and The external processing device is connected to the internal processing device through a third transmission line;

The internal processing device is configured to transmit intranet data sent by the client to the intranet monitoring device by using the first transmission line, and pass the external processing device to the third transmission line Transmitting the response information and the external network data to the client; wherein the intranet data includes the remote connection request and the access operation data; the external network data includes the terminal server for the Accessing the access response data returned by the operational data;

The intranet monitoring device is configured to transmit the intranet data to the external processing device by using the second transmission line when determining that the intranet data is preset legal data;

The external processing device is configured to send the intranet data to the terminal server, and transmit the response information and the external network data returned by the terminal server to the internal processing by using the third transmission line Device

The terminal server is configured to respond to the remote connection request, access the external network according to the access operation data, and return the access response data to the client.

Preferably, the internal processing device includes: a first internal processing unit connected to the internal network monitoring device through the first transmission line, and a second connected to the external processing device through the third transmission line Internal processing unit;

The first internal processing unit is configured to send the intranet data to the intranet monitoring device by using the first transmission line;

The second internal processing unit is configured to receive the response information and the external network data that are transmitted by the external processing device by using the third transmission line, and send the response information and the external network data to the client .

Preferably, the external processing device includes: a first external processing unit connected to the internal network monitoring device through the second transmission line, and a second internal processing unit connected to the second internal processing unit a second external processing unit;

The first external processing unit, configured to send the intranet data transmitted by the intranet monitoring device by using the second transmission line to the terminal server;

The second external processing unit is configured to transmit the response information sent by the terminal server and the external network data to the second internal processing unit by using the third transmission line.

Preferably, the first transmission line is an optical fiber whose signal transmission direction is unidirectionally transmitted from the internal processing device to the intranet monitoring device;

The second transmission line is an optical fiber that is unidirectionally transmitted from the intranet monitoring device to the external processing device in a signal transmission direction;

The third transmission line is an optical fiber that is unidirectionally transmitted from the external processing device to the internal processing device in a signal transmission direction.

On the other hand, the present application further provides a network protection device, which is disposed between a local area network and a terminal server connected to an external network, and the network protection device includes:

An internal processing device; an intranet monitoring device connected to the internal processing device through a first transmission line; and an external processing device connected to the intranet monitoring device via a second transmission line, and the external processing device passes the third a transmission line is connected to the internal processing device;

The internal processing device is configured to transmit, by the first transmission line, intranet data sent by a client in the local area network to the intranet monitoring device, and pass the external processing device through the third And transmitting, by the client, the remote connection request sent by the client to the terminal server, and the client receiving the And the access operation data sent by the terminal server to the terminal server after the response information of the remote connection request; the external network data includes access response data returned by the terminal server for the access operation data;

The external processing device is configured to send the intranet data to the terminal server, and transmit the response information and the external network data returned by the terminal server to the internal processing by using the third transmission line Device.

On the other hand, the application also provides a terminal server, which is set on a local area network and outside. Between the network, the terminal server is connected to a network protection device disposed between the local area network and the external network, and the network protection device is connected to a local area network, and the terminal server is connected to the external network;

The terminal server is configured to receive, by the network protection device, a remote connection request sent by a client in the local area network, and return, by using the network protection device, confirmation information for the remote connection request; The device receives the access operation data sent by the client, and accesses the external network according to the access operation data, and returns the access response data to the client by using the network protection device;

The access operation data is locally acquired operation data sent by the client to the terminal server after receiving the response information for the remote connection request.

According to the foregoing technical solution, when a client in the local area network needs to access the external network, the client needs to initiate a remote connection request to the terminal server, and after receiving the confirmation information of the remote connection request by the terminal server, The access operation data obtained locally by the client is sent to the terminal server to access the external network through the terminal server, so that when the malicious website is accidentally connected to the external network, the malicious website is only the terminal server outside the local area network. Connected, but not directly connected to the client in the LAN, so that the information in the client of the LAN can not be installed, nor can the Trojan or virus be installed in the client, thereby reducing the risk of data leakage inside the LAN and avoiding The client data in the LAN is destroyed, which improves the security of the data in the LAN.

DRAWINGS

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings to be used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only It is an embodiment of the present application, and can be provided by a person of ordinary skill in the art without any creative work. The figure obtains other figures.

1 is a schematic structural diagram of a network protection system in an embodiment of the present application;

2 is a schematic structural diagram of a network protection system in another embodiment of the present application;

3 is a schematic structural diagram of a network protection system in another embodiment of the present application;

FIG. 4 is a schematic structural diagram of an embodiment of a network protection device according to the present application.

detailed description

The embodiment of the present application discloses a network protection system, a network protection device, and a terminal server to improve the security of an internal LAN to access an external network.

The technical solutions in the embodiments of the present application are clearly and completely described in the following with reference to the drawings in the embodiments of the present application. It is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present application without departing from the inventive scope are the scope of the present application.

First, a network protection system is introduced.

Referring to FIG. 1 , it is a schematic structural diagram of a network protection system in an embodiment of the present application. In this embodiment, the network protection system includes:

Setting at least one client 11 in the local area network;

And a network protection device 12 and a terminal server 13 disposed between the local area network and the external network.

The network protection device is connected to the local area network, and the terminal server is connected to the external network. The connection relationship mentioned here may be a physical line connection or a wireless network connection.

The client 11 is configured to initiate a remote connection request to the terminal server, and after receiving the response information of the terminal server for the remote connection request, to the terminal The server sends the access operation data obtained locally.

The network protection device 12 includes:

The internal processing device 121 is connected to the internal processing device 121 via the first transmission line L1; and the external processing device 123 connected to the internal network monitoring device 122 via the second transmission line L2, and the external processing device 123 is connected to the internal processing device 121 via a third transmission line L3.

The internal processing device 121 is configured to transmit the intranet data sent by the client 101 to the intranet monitoring device 122 through the first transmission line, and transmit the external processing device 123 through the third transmission line. The response information and the external network data are sent to the client 11.

The intranet data includes: the remote connection request and the access operation data. The external network data includes: access response data returned by the terminal server for the access operation data.

The intranet monitoring device 122 is configured to transmit the intranet data to the external processing device through the second transmission line when determining that the intranet data is preset legal data.

The external processing device 123 is configured to send the intranet data to the terminal server, and transmit the response information and the external network data returned by the terminal server to the internal processing by using the third transmission line. Device.

The terminal server 13 is configured to respond to the remote connection request, access the external network according to the access operation data, and return the access response data to the client 11.

It can be seen that, in the embodiment of the present application, when the client in the local area network needs to access the external network, the client needs to initiate a remote connection request to the terminal server, and after receiving the confirmation information of the remote connection request by the terminal server, Sending the access operation data locally obtained by the client to the terminal server to access the external network through the terminal server, so that when the malicious website in the external network is accidentally connected, the malicious website is only outside the local area network. The terminal server is connected, and is not directly connected to the client in the local area network, so that the information in the client of the local area network cannot be installed, and the Trojan or the virus cannot be installed in the client, thereby reducing the risk of data leakage inside the local area network. It also avoids the destruction of client data in the LAN and improves the security of data in the LAN. Sex.

Meanwhile, after the remote connection request or the access operation data sent by the client in the local area network in the present application, the internal network data needs to be transmitted by the internal processing device in the network protection device to the internal network monitoring device via the first transmission line. And transmitted by the internal network monitoring device to the external processing device through the second transmission line, and finally sent by the external processing device to the terminal server; and the confirmation information returned by the terminal server and the external network data need to be processed by the external processing device through the third The transmission line is transmitted to the internal processing device, which can then be transmitted back to the client in the local area network. It can be known from the above data transmission process that the intranet data is transmitted from the local area network, and the transmission path of the data outside the local area network to the client in the local area network is different, and the transmission path of the external network of the intranet data of the local area network has unidirectionality, and the local area network The transmission path of external data to the local area network is also unidirectional.

Since the transmission path of the intranet data to the external network data transmission is unidirectional, the intranet monitoring device detects the intranet data as the preset legal data, and then transmits the intranet data to the second transmission line in one direction. For the external processing unit, the intranet data that is not legal data can be prevented from leaking into the external network, which improves the security of the data.

The external network data can only be transmitted to the internal processing device through the third transmission line through the external processing device, even if a Trojan virus or the like in the external network can cross the terminal server, and the external processing device passes the The three transmission lines transmit the internal processing device, and finally enter the client of the local area network, but after the intranet data in the client collected by the Trojan or the virus based on the network transmission protocol, the internal processing device needs to pass through the After the third transmission line is transmitted to the external processing device, the intranet data can be transmitted to the external network, and the unidirectionality of the transmission of the third transmission line is impossible for the intranet data to pass through the internal processing device. The three transmission lines are transmitted to the external processing device, thereby reducing the risk of data leakage inside the local area network.

The local area network in the present application may be an internal network of a certain factory, a company, or a home. Of course, the local area network may include a database server, a file server, and the like in addition to the client. The external network is relative to the local area network, is Refers to the network outside the LAN.

The client in the local area network can access the network in the local area network to realize data sharing in the local area network. When a user needs to use a client to access an external network, it is necessary to switch the state of the client from accessing the internal network to the state of accessing the external network.

The inventor found in the research that by adding a keyboard switch (KBS, Keyboard Switch) in the local area network, the client can be connected to the local area network or connected to the external network, and the user can realize the customer by switching the switch on the KBS. The end is connected to the local area network or to the external network. For example, after the user switches the KBS to the state connected to the external network, the KBS obtains the current mouse or keyboard operation data of the client, and the current operation data is used as access operation data for accessing the external network, and is sent to the external network. However, in practical applications, it is found that in order to switch the client from the local area network to the external network, each client in the local area network needs to be connected to a KBS, so that when the number of clients deployed in the local area network is large, A large amount of KBS is required, which increases the complexity of the network access system.

At the same time, to deploy KBS in the local area network, it is necessary to connect an outgoing network cable of the KBS to the client, and another outgoing network cable of the KBS is connected to the external network, that is, double network wiring is required. When the user accidentally connects the outgoing network cable connected to the external network to the client, the user's operation on the client causes the data in the client to be sent to the external network, causing information leakage.

In the network protection system of the present application, it is not necessary for each client to connect to the KBS, and only the client needs to initiate a remote connection request to the terminal server, and then can switch to the state connected to the external network, and determine the input operation of the client as The operation behavior of the external network is accessed, and the acquired access operation data is sent out, thereby further reducing the complexity of the network access system under the premise of improving the security of the internal LAN to access the external network.

It can be understood that, after the client initiates the remote connection request to the terminal server in the actual application, the operation data input by the user through the input device such as the keyboard and the mouse in the client can be regarded as an access operation for accessing the remote network. data. The terminal server According to the received access operation data, the specific network access behavior of the client may be determined, such as which external website is accessed, and which data needs to be obtained from the external website, and then the corresponding network access is performed according to the access operation data to obtain an influence. data.

Optionally, after the terminal server responds to the remote connection request, the corresponding operation interface data may be included in the confirmation information returned by the client. The client displays a corresponding operation interface according to the operation interface data, and the user can perform corresponding input operations in the operation interface for external network access.

In any of the above embodiments, the internal processing device in the network protection device may be only an integral device, and the internal processing device may correspond to the role of the internal terminal. Optionally, the internal processing device may include two internal processing units to separately send the intranet data and send the external network data back to the intranet.

Specifically, reference may be made to FIG. 2, which is a schematic structural diagram of a network protection system according to another embodiment of the present application. The network protection system of the previous embodiment is different in the following embodiments:

In this embodiment, the internal processing device 121 in the network protection device 12 includes:

a first internal processing unit 1211 connected to the internal network monitoring device via a first transmission line L1, and a second internal processing unit 1212 connected to the external processing device 123 via the third transmission line L3;

Correspondingly, the first internal processing unit 1211 is configured to send the intranet data to the intranet monitoring device through the first transmission line L1.

The second internal processing unit 1212 is configured to receive the response information and the external network data that the external processing device 123 transmits through the third transmission line L3, and send the response information and the external network data to the client 11 .

It can be seen that, in this embodiment, the client first sends the intranet data to the first internal processing unit 1212 in the network protection device, and the first internal processing unit 1211 transmits the data to the first internal processing unit 1211. The intranet monitoring unit is transmitted by the intranet monitoring unit to the external processing unit 123 through the second transmission line to transmit the intranet data to the terminal server through the external processing unit; and the external data returned by the terminal server Then, the external processing unit 123 transmits the data to the second internal processing unit 1232 via the third transmission line, thereby realizing the unidirectional data transmission of the intranet data and the external network data by using different transmission lines.

It can be understood that, in any of the above embodiments, the internal network monitoring device can preset legal data, for example, the input data of the mouse, the keyboard, and the like in the client can be regarded as legal data, if the client transmission is detected. The intranet data includes data other than input data such as a mouse or a keyboard, and the intranet data is not transmitted to the external processing device.

Further, the external processing device may also be composed of two external processing units, and the two external processing units respectively implement the intranet data to be sent out, and the external network data is transmitted back to the internal area of the local area network.

Referring to FIG. 3, a schematic flowchart of a network protection system according to another embodiment of the present application is shown. The difference between this embodiment and any of the previously described network protection systems is that:

In this embodiment, the external processing device 123 in the network protection device 12 may include:

A first external processing unit 1231 connected to the intranet monitoring device via the second transmission line L2, and a second external processing unit 1232 connected to the second internal processing unit 1212 via the third transmission line L3.

Correspondingly, the first external processing unit 1231 is configured to send the intranet data transmitted by the intranet monitoring device through the second transmission line L2 to the terminal server 13;

The second external processing unit 1232 is configured to transmit the response information and the external network data sent by the terminal server 13 to the second internal processing unit through the third transmission line L3.

It can be seen that, in the embodiment, on the basis of realizing the one-way transmission of the intranet data and the external network data, the intranet data is transmitted outward and the external data of the external network is transmitted to the internal area of the local area network respectively through different network protection devices. Internal processing unit and external processing unit, further reducing the risk of internal data being compromised and improving internal network access to the outside Network security.

It can be understood that, in the embodiment of FIG. 4, the internal processing device includes a first internal processing unit and a second internal processing unit as an example, but in practical applications, if the internal processing unit does not separately include the first An internal processing unit and a second internal processing unit, the composition of the external processing device in this embodiment is also applicable, except that the second internal processing unit of the external processing device can directly communicate with the third internal processing unit through the third transmission line. The internal processing device can be connected.

In any of the above embodiments, in order to enable one-way transmission of the above intranet data and the external network data, the internal processing device, the monitoring device, and the external processing device, or the internal processing device and the external processing device, respectively, may be included. Settings are made in the unit to limit the direction of data transfer. For example, the intranet data received by the internal processing device from the client can only be transmitted to the monitoring device through the first transmission line, and the external network data received by the external processing device from the terminal server can only pass through the third The transmission line is transmitted to the internal processing device.

Optionally, in order to achieve unidirectional transmission of data, the first transmission line, the second transmission line, and the third transmission line can only complete one-way data signal transmission.

For example, in the present application, the first transmission line can be set as an optical fiber whose signal transmission direction is unidirectionally transmitted from the internal processing device to the intranet monitoring device.

Correspondingly, the second transmission line may be configured as an optical fiber whose signal transmission direction is unidirectionally transmitted from the intranet monitoring device to the external processing device;

The third transmission line may be provided as an optical fiber whose signal transmission direction is unidirectionally transmitted from the external processing device to the internal processing device.

That is to say, the first transmission line, the second transmission line and the third transmission line both utilize the unidirectional transmission property of the optical signal to realize the one-way transmission of the data signal on the optical fiber, so as to realize the intranet data and the external network. The unidirectionality of data during transmission. Specifically, a corresponding optical transmitter and receiver are disposed in each of the transmission lines. For example, the first transmission line actually includes an optical transmitter connected to the internal processing device and is monitored by the internal network. The optical receiver connected to the device is connected by an optical fiber between the optical transmitter and the optical receiver. The second transmission line actually includes an optical transmitter connected to the intranet monitoring device, and an optical receiver connected to the external processing device, and the optical transmitter and the optical receiver are connected by an optical fiber; correspondingly, The third transmission line also actually includes an optical transmitter connected to the external processing device and an optical receiver connected to the internal processing device, and the optical transmitter and the optical receiver are connected by an optical fiber.

In any of the above embodiments, in order to further improve the security of network access in the network protection system, the network protection system may further set a firewall between the local area network and the network protection device.

In another aspect, the present application also provides a network protection device. Referring to FIG. 4, it is a schematic structural diagram of an embodiment of a network protection device according to the present application. In this embodiment, the network protection device is disposed between a local area network and a terminal server connected to an external network. The network protection device can include:

An internal processing device 41; an intranet monitoring device 42 connected to the internal processing device 41 via a first transmission line L1; and an external processing device 42 connected to the intranet monitoring device 41 via a second transmission line L2, and the external processing device 43 is connected to the internal processing device 41 via a third transmission line L3.

The internal processing device 41 is configured to transmit the intranet data sent by the client in the local area network to the intranet monitoring device 42 through the first transmission line, and transmit the external processing device 43 through the third transmission line L3. The response information and the external network data are sent to the client.

The intranet data includes a remote connection request sent by the client to the terminal server, and an access operation sent by the client to the terminal server after receiving the response information of the terminal server for the remote connection request. data;

The external network data includes access response data returned by the terminal server for the access operation data.

The intranet monitoring device 42 is configured to transmit the intranet data to the external processing device by using the second transmission line when determining that the intranet data is preset legal data. Set.

The external processing device 43 is configured to send the intranet data to the terminal server, and transmit the response information and the external network data returned by the terminal server to the internal through the third transmission line. Processing device.

It can be seen that, in the embodiment of the present application, when the client in the local area network needs to access the external network, the client initiates a remote connection request to the terminal server, and sends the request to the network protection device to request the remote connection through the network protection device. Sending to the terminal server, after receiving the confirmation information of the terminal server for the remote connection request, the client obtains the access operation data locally obtained by the client through the network protection device to be accessed by the terminal server. An external network, such that when a malicious website is accidentally connected to the external network, since the malicious website is only connected to the terminal server outside the local area network, and is not directly connected to the client in the local area network, the customer cannot be from the local area network. The information in the terminal can not install Trojans or viruses in the client, which reduces the risk of data leakage inside the LAN, and also avoids the destruction of client data in the LAN, and improves the security of data in the LAN.

In addition, after the network protection device receives the intranet data sent by the client, the intranet data is transmitted by the internal processing device to the external processing device via the first transmission line, the intranet monitoring device, and the second transmission line, and The external processing device finally sends the data to the terminal server; and the external network data returned by the terminal server is transmitted by the external processing device to the internal processing device via the third transmission line, thereby realizing one-way transmission of the intranet data and the external network data sub-path, avoiding Intranet data that is not legal data is leaked to the external network. At the same time, even if the Trojan virus in the external network can cross the terminal server and finally enter the client, the virus or the like can not transmit data from the client to the original path, thereby preventing the intranet data from being leaked. Improves the security of devices accessing the external network in the LAN.

Optionally, the internal processing device may include: a first internal processing unit connected to the intranet monitoring device through the first transmission line, and a first connection to the external processing device through the third transmission line Two internal processing units;

Then, the first internal processing unit is configured to use the first transmission line to The intranet data is sent to the intranet monitoring device;

Further, the external processing device may include: a first external processing unit connected to the intranet monitoring device through the second transmission line, and a second internal processing unit connected through the third transmission line a second external processing unit;

The composition of the above internal processing device and external processing device and related description can be referred to the related description of the embodiment of FIG. 2 and FIG. 3.

Optionally, the first transmission line is an optical fiber that is unidirectionally transmitted from the internal processing device to the intranet monitoring device in a signal transmission direction;

The third transmission line is an optical fiber that is unidirectionally transmitted from the external processing device to the internal processing device in a signal transmission direction. For details, refer to related descriptions of the previous embodiments, and details are not described herein again.

In another aspect, the present application further provides a terminal server, where the terminal server is disposed between a local area network and an external network, and the terminal server is connected to a network protection device disposed between the local area network and the external network, and The network protection device is connected to a local area network, and the terminal server is connected to the external network;

The terminal server is configured to receive, by the network protection device, a remote connection request sent by a client in the local area network, and return, by using the network protection device, Acknowledgement information of the remote connection request; receiving, by the network protection device, access operation data sent by the client, accessing the external network according to the access operation data, and responding to the access by the network protection device Data is returned to the client;

It is to be understood that the terminal server mentioned in any of the above embodiments may be a terminal server of windows, a cloud host, or a Linux server providing remote access, and is not limited herein.

The various embodiments in the present specification are described in a progressive manner, and each embodiment focuses on differences from other embodiments, and the same similar parts between the various embodiments may be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

The above description of the disclosed embodiments enables those skilled in the art to make or use the application. Various modifications to these embodiments are obvious to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the application. Therefore, the application is not limited to the embodiments shown herein, but is to be accorded the broadest scope of the principles and novel features disclosed herein.

Claims

A network access system, comprising: at least one client disposed in a local area network, a network protection device and a terminal server disposed between the local area network and an external network, wherein the terminal server is connected to an external network;

The client is configured to initiate a remote connection request to the terminal server, and after receiving the response information of the terminal server for the remote connection request, send the locally acquired access operation to the terminal server. data;

The network protection device includes: an internal processing device; an intranet monitoring device connected to the internal processing device through a first transmission line; and an external processing device connected to the intranet monitoring device through a second transmission line, and The external processing device is connected to the internal processing device through a third transmission line;

The internal processing device is configured to transmit intranet data sent by the client to the intranet monitoring device by using the first transmission line, and pass the external processing device to the third transmission line Transmitting the response information and the external network data to the client; wherein the intranet data includes the remote connection request and the access operation data; the external network data includes the terminal server for the Accessing the access response data returned by the operational data;

The intranet monitoring device is configured to transmit the intranet data to the external processing device by using the second transmission line when determining that the intranet data is preset legal data;

The external processing device is configured to send the intranet data to the terminal server, and transmit the response information and the external network data returned by the terminal server to the internal processing by using the third transmission line Device

The terminal server is configured to respond to the remote connection request, access the external network according to the access operation data, and return the access response data to the client.
The system of claim 1 wherein said internal processing means comprises: a first internal processing unit coupled to said intranet monitoring device via said first transmission line, and said third transmission line a second internal processing unit coupled to the external processing device;

The first internal processing unit is configured to send the intranet data to the intranet monitoring device by using the first transmission line;

The second internal processing unit is configured to receive the response information and the external network data that are transmitted by the external processing device by using the third transmission line, and send the response information and the external network data to the client .
The system according to claim 2, wherein said external processing means comprises: a first external processing unit connected to said intranet monitoring device via said second transmission line, and said third transmission line a second external processing unit coupled to the second internal processing unit;

The first external processing unit, configured to send the intranet data transmitted by the intranet monitoring device by using the second transmission line to the terminal server;

The second external processing unit is configured to transmit the response information sent by the terminal server and the external network data to the second internal processing unit by using the third transmission line.
The system according to any one of claims 1 to 3, wherein the first transmission line is an optical fiber whose signal transmission direction is unidirectionally transmitted from the internal processing device to the intranet monitoring device;

The second transmission line is an optical fiber that is unidirectionally transmitted from the intranet monitoring device to the external processing device in a signal transmission direction;

The third transmission line is an optical fiber that is unidirectionally transmitted from the external processing device to the internal processing device in a signal transmission direction.
The system according to claim 1, wherein the system further comprises: a firewall disposed between the local area network and the network protection device.
A network protection device, configured to be disposed between a local area network and a terminal server connected to an external network, where the network protection device comprises:

An internal processing device; an intranet monitoring device connected to the internal processing device through a first transmission line; and an external processing device connected to the intranet monitoring device via a second transmission line, and the external processing device passes the third a transmission line is connected to the internal processing device;

The internal processing device is configured to transmit, by the first transmission line, intranet data sent by a client in the local area network to the intranet monitoring device, and pass the external processing device through the third And transmitting, by the client, the remote connection request sent by the client to the terminal server, and the client receiving the And the access operation data sent by the terminal server to the terminal server after the response information of the remote connection request; the external network data includes access response data returned by the terminal server for the access operation data;

The intranet monitoring device is configured to transmit the intranet data to the external processing device by using the second transmission line when determining that the intranet data is preset legal data;

The external processing device is configured to send the intranet data to the terminal server, and transmit the response information and the external network data returned by the terminal server to the internal processing by using the third transmission line Device.
The apparatus according to claim 6, wherein said internal processing means comprises: a first internal processing unit connected to said intranet monitoring means via said first transmission line, and said third transmission line a second internal processing unit coupled to the external processing device;

The first internal processing unit is configured to send the intranet data to the intranet monitoring device by using the first transmission line;

The second internal processing unit is configured to receive the response information and the external network data that are transmitted by the external processing device by using the third transmission line, and send the response information and the external network data to the client .
The apparatus according to claim 7, wherein said external processing means comprises: a first external processing unit connected to said intranet monitoring means via said second transmission line, and said third transmission line a second external processing unit coupled to the second internal processing unit;

The first external processing unit, configured to send the intranet data transmitted by the intranet monitoring device by using the second transmission line to the terminal server;

The second external processing unit is configured to transmit the response information sent by the terminal server and the external network data to the second internal processing unit by using the third transmission line.
The apparatus according to any one of claims 6 to 8, wherein the first transmission line is an optical fiber whose signal transmission direction is unidirectionally transmitted from the internal processing device to the intranet monitoring device;

The second transmission line is an optical fiber that is unidirectionally transmitted from the intranet monitoring device to the external processing device in a signal transmission direction;

The third transmission line is an optical fiber that is unidirectionally transmitted from the external processing device to the internal processing device in a signal transmission direction.
A terminal server, configured to be disposed between a local area network and an external network, wherein the terminal server is connected to a network protection device disposed between the local area network and the external network, and the network protection device is connected to a local area network The terminal server is connected to the external network;

The terminal server is configured to receive, by the network protection device, a remote connection request sent by a client in the local area network, and return, by using the network protection device, confirmation information for the remote connection request; The device receives the access operation data sent by the client, and accesses the external network according to the access operation data, and returns the access response data to the client by using the network protection device;

The access operation data is locally acquired operation data sent by the client to the terminal server after receiving the response information for the remote connection request.