WO2020087782A1 - 一种数据流量控制的外接式终端防护设备及防护系统 - Google Patents

一种数据流量控制的外接式终端防护设备及防护系统 Download PDF

Info

Publication number
WO2020087782A1
WO2020087782A1 PCT/CN2019/072030 CN2019072030W WO2020087782A1 WO 2020087782 A1 WO2020087782 A1 WO 2020087782A1 CN 2019072030 W CN2019072030 W CN 2019072030W WO 2020087782 A1 WO2020087782 A1 WO 2020087782A1
Authority
WO
WIPO (PCT)
Prior art keywords
interface
control module
external
data
terminal protection
Prior art date
Application number
PCT/CN2019/072030
Other languages
English (en)
French (fr)
Inventor
杜华
艾伟
蔡镇河
张昊
Original Assignee
北京博衍思创信息科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京博衍思创信息科技有限公司 filed Critical 北京博衍思创信息科技有限公司
Priority to US16/978,774 priority Critical patent/US11170133B2/en
Publication of WO2020087782A1 publication Critical patent/WO2020087782A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F13/00—Interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units
    • G06F13/38—Information transfer, e.g. on bus
    • G06F13/42—Bus transfer protocol, e.g. handshake; Synchronisation
    • G06F13/4282—Bus transfer protocol, e.g. handshake; Synchronisation on a serial bus, e.g. I2C bus, SPI bus
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0236—Filtering by address, protocol, port number or service, e.g. IP-address or URL
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/70—Protecting specific internal or peripheral components, in which the protection of a component leads to protection of the entire computer
    • G06F21/82—Protecting input, output or interconnection devices
    • G06F21/85—Protecting input, output or interconnection devices interconnection devices, e.g. bus-connected or in-line devices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2141—Access rights, e.g. capability lists, access control lists, access tables, access matrices
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0254—Stateful filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Definitions

  • the invention belongs to the technical field of computer security, and in particular relates to an external terminal protection device for data flow control and a corresponding protection system.
  • the present invention provides an external terminal protection device and protection system for data flow control to solve the above problems, so as to realize the takeover of each interface of the protected host, and ensure that the USB interface or The serial port device must be completed by an external terminal protection device, so that the purpose of protecting the USB port or serial port of the protected host can be achieved without installing security protection software on the protected host.
  • an external terminal protection device for data flow control which includes: an interface control module for providing multiple data interfaces to connect the protected host and one or more external devices respectively; system control The board is used to monitor the data transmission status of each data interface in the interface control module in real time, and perform flow control on the data of each data interface.
  • the external terminal protection device for data flow control is externally connected to the protected host, and connects the interface control module with each data interface of the protected host according to the type.
  • the plurality of data interfaces of the interface control module further include an internal interface, an external interface, and a forwarding interface; the internal interface is used to connect to each data interface of the protected host according to the interface type; The external interface is used to access one or more external devices.
  • the external device is suitable for data interaction with the protected host through the external terminal protection device; the forwarding interface is used to forward data traffic of each interface type to The system control module.
  • the interface control module further includes hardware control logic for realizing connection and disconnection of physical lines between the interfaces in the interface control module.
  • system control module further includes security authentication of the external device to confirm whether the external device is a permitted access device.
  • the system control module when the system control module authenticates the external device after security and confirms that the external device is not a permitted access device, it notifies the interface control module of prohibiting data transmission of the external device through the bus; the interface control The hardware control logic in the module maintains the state of disconnecting the physical line of the external interface and the forwarding interface accessed by the external device, so as to filter and prohibit data transmission after the external device access.
  • the interface control module when the system control module authenticates the external device after security, and confirms that the external device is a permitted access device, the interface control module is notified via the bus to allow data transmission of the external device; the interface control The hardware control logic in the module connects the physical lines of the external interface accessed by the external device and the forwarding interface.
  • the data interface further includes one or more network interfaces;
  • the interface control module further includes a switching chip for acquiring the register status of each network interface, setting the working mode of the interface control module; the system control The module monitors the state of the network interface register in the switching chip, so as to obtain the connection state of each network interface in the interface control module in real time.
  • system control module when it detects that there is a change in the connection status of one or more network interfaces, it sends an alarm prompt to the corresponding network interface status change.
  • the system control module sets the interface control module to a traffic mirroring mode through the switching chip, and through the forwarding interface in the interface control module, the internal interface and / or the external interface in the interface control module Do traffic mirroring.
  • the system control module sets the interface control module to the network protocol filtering mode through the switching chip, and through the forwarding interface in the interface control module, the internal control interface and the external interface of the interface control module Network data filtering between data traffic.
  • system control module further sets a security policy to perform security detection on the data transmitted by the external device accessed through the interface control module; the interface control module will filter the data after the security policy The traffic is forwarded to the protected host.
  • system control module may be an ARM or x86 based control module.
  • the present application provides a protection system for data flow control, including:
  • One or more external devices are adapted to perform data interaction with the protected host through the external terminal protection device;
  • the external terminal protection equipment As mentioned above, the external terminal protection equipment,
  • the external terminal protection device is externally connected to the protected host, so that the one or more external devices communicate with the protected host through the external terminal protection device.
  • the present invention has at least one or more of the following technical effects: it can realize the takeover of each data interface of the protected host, ensuring that the data communication using each interface of the protected host is completed through an external terminal, thereby eliminating the need Install traffic monitoring and security protection software on the protected host to achieve the function of protocol filtering and auditing of various types of data traffic of the protected host, thereby achieving the effects of low-latency network auditing and high reliability protocol filtering, and further To the purpose of security protection, and greatly reduce the network security risks of the overall system, comprehensively solve the potential security risks such as virus Trojan implantation and traffic abnormality that may be generated by each interface.
  • FIG. 1 is an application scenario of a protection system for data flow control according to the present invention
  • FIG. 2 is a schematic diagram of the internal structure of an external terminal protection device according to the present invention.
  • FIG 5 is an embodiment of network data flow control of an external terminal protection device according to the present invention.
  • FIG. 6 is a network deployment embodiment of a protection system for data flow control according to the present invention.
  • the external terminal protection equipment for data flow control proposed by the present invention includes an interface control module and a system control module.
  • the interface control module is used to provide multiple data interfaces to connect the protected host and one or more external devices respectively.
  • the system control module is used to monitor the data transmission status of each data interface in the interface control module in real time and perform flow control on the data of each data interface. It can be seen that the present invention provides a terminal protection device in the form of hardware, which can achieve protocol filtering and auditing of various types of data traffic without installing traffic monitoring and security protection software on the protected host, thereby achieving a low-latency network
  • the effects of auditing and high-reliability protocol filtering have comprehensively resolved potential security risks such as virus Trojan implantation and traffic anomalies that may arise from each interface.
  • the “module” referred to in the present invention is a hardware module, that is, a hardware module composed of tangible electronic components such as circuits, data processing devices, memories, and buffers.
  • the interface control module and the system control module in the present invention may be a combination of physically or functionally independent elements, or may be a combination of overall elements that are physically or functionally integrated together.
  • the interface control module is composed of an interface control board
  • the system control module is composed of a system control board. Both the interface control board and the system control board are circuit boards with integrated electronic components, and the two are connected by a bus .
  • the interface control module and the system control module can also be integrated on a circuit board. Therefore, the key of the present invention lies in the control relationship between the interface control module and the system control module, but is not limited to the combination of the spatial or physical connection of the electronic components constituting the respective modules.
  • FIG. 1 shows an application scenario of an embodiment of a protection system for data flow control according to the present invention.
  • the external terminal protection device of the present invention is provided with corresponding to each interface type of the protected host.
  • the internal interface also provides external interfaces of corresponding types. Each internal interface is used to connect to the protected host, and the external interface is used to connect to external devices that need to interact with the protected host.
  • the terminal protection equipment is externally connected to the protected host, and each interface on the protected host to be protected (such as USB port UC1, UC2, COM port CC0, network port EC0) is connected to itself through various types of connection lines
  • each interface on the protected host to be protected (such as USB port UC1, UC2, COM port CC0, network port EC0) is connected to itself through various types of connection lines
  • Corresponding type of internal interface for example, connect the interfaces UC1 and UC2 of the protected host to the internal USB ports UA4 and UA3 of the external terminal protection device, connect the serial port CC0 to the internal serial port CA2, and the network port EC0 Connect to the internal network port EA2.
  • U disk, optical drive, serial port connection device, etc. are all connected to the external interfaces on the external terminal protection device, and the external terminal protection device can communicate with the protected host to achieve external Control of data flow between the device and the protected host, such as external U disk device access through the external interface UA1 of the external terminal protection device, USB optical drive access through the external interface UA2, serial port connection device access through the external interface CA1 .
  • the external devices such as U disk, USB optical drive and serial connection device need to communicate with the protected host, and they cannot be directly connected to the protected host, and the communication must be transferred through the corresponding external interface of the external terminal protection device.
  • the data transmitted through the external device needs to first pass the data flow control of the external terminal protection device, so that the data transmission can be controlled by protocol filtering, traffic mirroring, traffic auditing, and security detection.
  • FIG. 2 shows an embodiment of the internal structure of the external terminal protection device of the present invention.
  • the external terminal protection device is mainly composed of an interface control board A and a system control board B.
  • the interface control board A supports USB, serial port, and network communication, and it communicates with the system control board B through a control connection line E
  • the connection (such as a bus) is used to control the different working modes of the interfaces on the interface control board A, such as the USB interface, the serial port, and the network port, so as to realize the function of safely controlling the access of various external devices.
  • the system control board A can realize the control of the working mode of each interface.
  • the working modes include available, unavailable, network protocol filtering, traffic mirroring or traffic auditing, etc., but the present invention is not limited to a specific working mode control type.
  • the system control board B may be connected to the interface control board A through an I2C or SPI interface, but the present invention is not limited to such a specific control connection interface.
  • the interface control board forwards the data traffic transmitted in the external interface and the internal interface to the system control board through various types of forwarding interfaces (serial port, network port, USB, etc. in the data connection F).
  • the interface control board in the external terminal protection device can also be connected to an internal memory, as shown in FIG. 2 by hardware storage D, which is used to transfer data exchanged between the interfaces on the interface control board.
  • the system control board When an external device is accessed through various types of external interfaces on the interface control board, the system control board performs security authentication on the different types of interfaces on the interface control board according to the set security policy to confirm whether the external device is Allow access to the device.
  • the security functions implemented by the external terminal protection device include but are not limited to, the administrator pre-sets permission settings and security policy settings for the external terminal protection device;
  • the security policy includes but is not limited to: enabling data Import (such as USB interface), enable data export (such as USB interface), USB access device restrictions (such as USB device-based Vendor ID, ie vendor identification code, and / or Product ID, ie product identification code), data Import antivirus strategy, data export black and white list control strategy, data export format control strategy, enable serial port access strategy, USB interface insertion protection, enable network communication audit, enable firewall function, set serial port command black and white list, etc.
  • the security policy includes: after the administrator sets each security policy, the related security policies will be executed one by one by the external terminal protection device.
  • the security policy includes: the administrator also controls whether the external terminal protection device enters the monitoring and protection mode. This mode will monitor the connection with the protected host, and an alarm will be generated under abnormal circumstances.
  • the security policy includes: when an abnormal alarm or interface access condition needs to be recorded for subsequent administrator query, the internal memory is further used to further record the alarm information or interface access log information.
  • the interface control board further includes hardware control logic, which is used to realize the connection and disconnection of physical lines between the interfaces in the interface control board.
  • hardware control logic which is used to realize the connection and disconnection of physical lines between the interfaces in the interface control board.
  • the system control board After the system control board securely authenticates the external device and confirms that the external device is a permitted access device, it notifies the interface control board to allow data transmission of the external device through the bus; the hardware in the interface control board The control logic connects the physical line of the external interface and the forwarding interface accessed by the external device.
  • FIG. 3 an embodiment of USB data flow control inside an external terminal protection device according to the present invention.
  • the interface control board further contains hardware control logic, which is used to realize the connection and disconnection of the physical lines between the interfaces in the interface control board.
  • the internal USB interface UA3 of the interface control board is connected to the USB port of the protected host, the forwarding interfaces UB1 and UB2 are respectively connected to the USB interfaces UD3 and UD4 of the system control board, and the external USB interface UA1 is inserted into the U disk of the external device or Removable storage media, UB3 is inserted into the internal USB storage for transferring data, and the CTRL port is used as a bus interface to connect the control interface of the system control board.
  • the system control board When the data in the U disk of the external device needs to be imported to the protected host, the system control board notifies the interface control board through the bus transmission control instructions to control the hardware control logic to connect the physical line between UA1 and UB1, and put the U disk Data1 of the data is copied into the cache of the system control board. During this period, the hardware control logic keeps the physical lines of the forwarding interface UB1 (connected to the system control board) and UB3 (connected to the internal USB storage) in a disconnected state, while maintaining internal The physical line of the USB interface UA3 (connected to the protected host) is disconnected from UB3.
  • the switch of the physical line between UA1 and UB1 is disconnected, the physical line between UB1 and UB3 is connected, the data stored in the USB of UB3 is connected to the UB1 interface, and the system control board secures the data Data1 in the cache Sex detection, to achieve the anti-virus and other security tests on the USB storage inserted by UA1 under the isolated state of the protected host.
  • Data1 passes the security test, the data Data1 is copied to the internal USB storage of the interface control board UB3 interface, during which the hardware control logic controls the physical connection between UA1 and UB1, UA3 and UB3 to be in a disconnected state.
  • the hardware control logic disconnects the physical connection between UB1 and UB3, controls the physical connection between UA3 and UB3, and sends the data in the internal USB storage on the UB3 interface Data1 to the protected host through the internal interface UA3 port.
  • the control logic disconnects the physical lines of UA1 and UB1, UB1 and UB3.
  • the system control board notifies the interface control board through the bus transmission control instruction to control the hardware control logic to control the physical line connection of the internal interface UA3 and UB3 ,
  • the internal USB storage on the UB3 interface will communicate with the protected host data, the user operates the protected host B to import the data Data2 into the internal USB storage, during which the hardware control logic remains between the external interface UA1 and the forwarding interfaces UB1, UB1 and UB3 'S physical line is in a disconnected state.
  • the hardware control logic disconnects the physical line between UA3 and UB3, connects the physical line between UB1 and UB3, and forwards the data Data2 in the internal USB storage on the UB3 interface to the buffer of the system control board through the forwarding interface UB1, The system control board conducts a compliance check on the data Data2 in the cache to confirm whether the exported data meets the set compliance policy.
  • the hardware control logic maintains the physical between the external interface UA1 and the forwarding interface UB1, the internal interface UA3 and UB3 The line connection is disconnected.
  • the hardware control logic After confirming that the exported data Data2 passes the compliance check, the hardware control logic connects the physical line between the external interface UA1 and the forwarding interface UB1, and copies the data Data2 into the external device U disk of the UA1 interface, during which the hardware control logic maintains the forwarding interface The physical lines between UB1 and UB3 and the internal interfaces UA3 and UB3 are disconnected. At this point, the data export process is complete.
  • the process of importing and exporting the data of the terminal protection device is controlled by the hardware control logic. At any time, only one connection is connected, and the other connections are in a physical line disconnection state, which ensures that the external device is connected Protect the unidirectional / bidirectional transmission of data between the hosts and carry out data traffic filtering prohibition control.
  • the terminal protection device can also provide a non-storage USB device direct connection control, mainly for some non-storage USB devices that require direct access, such as a USB optical drive, dongle, etc. . Similar to the above data import and export control, the direct device control controls the data flow of the USB device through the hardware control logic of the system control board control interface control board.
  • the hardware connection is as follows: the interface control board in the terminal protection device
  • the internal USB interface UA4 is connected to the USB interface of the protected host
  • the forwarding interface UB2 is connected to the USB interface of the system control board
  • the external USB interface UA2 is inserted into an external device (such as a USB optical drive) that needs to be directly connected to the protected host B
  • the interface control board CTRL The port access bus connects the control interface of the system control board.
  • the terminal protection device directly controls the USB device as follows:
  • the interface control board passes the bus Notify the system control board, the system control board control interface
  • the hardware control logic of the control board connects the physical line of the interface UA2 and the forwarding interface UB2, so that the USB optical drive inserted on the UA2 interface communicates with the USB interface of the system control board, during which the hardware control
  • the logic keeps the interface UA2 disconnected from the physical line connecting the internal interface UA4 of the protected host.
  • the system control board performs security authentication on the USB optical drive on the UA2 interface to confirm whether the external device is a permitted access device. After confirming that the USB optical drive is a permitted access device, the hardware control logic will change the external interface UA2 and the internal interface UA4 The physical line is connected to realize the connection between the USB optical drive inserted on the UA2 interface and the protected host.
  • the hardware control logic automatically disconnects the physical line between the interface and other interfaces. For example, when an external device inserted on the UA2 interface is connected to the UA4 interface, the system control board will monitor the connection status of the external device inserted into the UA2 on the interface control board in real time, and will automatically disconnect the connection once the external device is pulled out of the interface.
  • an embodiment of a serial port data flow control inside an external terminal protection device can implement filtering of serial port communication data and prohibit input of certain illegal commands.
  • the system control board notifies the hardware control logic of the interface control board through the bus to control the disconnection and connection of the physical line between the external serial interface CA1 and the forwarding interface CB1, the internal serial interface CA2 and the forwarding interface CB2.
  • the external device connected to the external serial interface CA1 first needs to pass the security authentication of the system control board, and then the serial ports CD1 and CD2 realize data communication, and the hardware control logic of the interface control board connects the serial ports CA1 and CB1, CA2 and CB2 The physical line, so as to realize the data communication from the external serial device on the external serial interface CA1 to the internal serial interface CA2, and then to the protected host.
  • system control board disconnects the physical connection between CA1 and CB1, CA2 and CB2 through hardware control logic, and cuts off the serial communication line between CA1 and CA2. Since the communication between CA1 and CA2 is forwarded through CB1 and CB2, the system control board can filter the serial communication data and prohibit certain illegal command input.
  • the terminal protection device relies on a switching chip, especially a dedicated network switching chip, thereby implementing network data flow control and auditing functions.
  • a switching chip is integrated on the interface control board in the terminal protection device, which is used to obtain the register status of each data interface and set the working mode of the interface control board.
  • the interface control board is connected to the system control board through a bus (that is, the illustrated control line), and the network port E5 of the system control board is connected to the forwarding interface network port E4 of the interface control board.
  • the terminal protection device of this embodiment may use a dedicated network switching chip to support network traffic mirroring audit and network protocol filtering functions without affecting network delay.
  • the network audit firewall design of the terminal protection equipment described in this solution implements network data flow control by relying on dedicated hardware, thereby achieving low-latency network audit and high reliability protocol filtering.
  • the terminal protection device may have a network cable anti-unplugging function
  • the system control board obtains the external network interface E1 and the internal network interface E2 by reading the switch chip network port register status Connection status.
  • the connection status is described as link connection failure / success.
  • the system control board can obtain the status information of the network port, and then realize the alarm of the insertion or removal of the network cable.
  • the terminal protection device may have a network audit function.
  • the external interface E1 is connected to a local area network or an industrial control network
  • the internal interface E2 is connected to the network port of the protected host B.
  • the system control board sets the interface control board to the traffic mirroring mode through the switch chip based on the local operation instruction or the remote network control instruction of the remote control center, and controls the interface control board through the forwarding interface E4 in the interface control board
  • the network interfaces E1 and E2 do traffic mirroring. From this, the network port E4 can obtain the network communication data from the two network ports E1 and E2, without affecting the data communication between E1 and E2, and thus the network between the protected host B and the external LAN or industrial control network can be realized. Traffic audit.
  • this method uses the switch chip to set the working mode of the interface control board without changing the network topology or adding additional network equipment.
  • the terminal protection device may have a network protocol filtering function.
  • the system control board sets the interface control board to the network protocol filtering mode through the exchange chip based on the local operation instruction or the remote network control instruction of the remote control center, and forwards the interface control board through the forwarding interface E4 in the interface control board
  • the data traffic between the external interface E1 and the internal interface E2 in the network protocol filtering so as to achieve network protocol filtering on the data traffic of the protected host B and the external LAN or industrial control Ethernet network.
  • system control board can control the switching chip to switch the network port working mode of the interface control board, such as switching the traffic mirroring mode of the network interface E4 to a network protocol filtering mode, or switching the network protocol filtering mode of the network interface E4 to traffic mirroring Mode, or switch between other working modes.
  • FIG. 6 is a network deployment embodiment of the protection system of the present invention.
  • the protection system includes one or more external devices; a protected host; and an external terminal protection device, wherein the external terminal protection device is externally connected to the protected host so that the one or more external devices Interface communication with the protected host through the external terminal protection equipment.
  • the external terminal protection equipment is as described above, which will not be repeated here.
  • the protection system further includes a control center that remotely controls the external terminal protection equipment.
  • the control center is composed of a server, a management workstation, and other nodes, and is connected to the external terminal protection equipment through a network switching node. On the network port EA1.
  • modules in the device in the embodiment can be adaptively changed and set in one or more devices different from the embodiment.
  • the modules or units or components in the embodiments may be combined into one module or unit or component, and in addition, they may be divided into a plurality of submodules or subunits or subcomponents. Except that at least some of such features and / or processes or units are mutually exclusive, all features disclosed in this specification (including the accompanying claims, abstract and drawings) and any method so disclosed or All processes or units of equipment are combined. Unless expressly stated otherwise, each feature disclosed in this specification (including the accompanying claims, abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose.
  • the various component embodiments of the present invention may be implemented in hardware, or implemented in software modules running on one or more processors, or implemented in a combination thereof.
  • a microprocessor or a digital signal processor may be used to implement some of the photo entry device, computing device, and computer-readable storage medium for text content according to embodiments of the present invention. Or some or all functions of all components.
  • the present invention may also be implemented as a device or device program (eg, computer program and computer program product) for performing part or all of the method described herein.
  • Such a program implementing the present invention may be stored on a computer-readable medium, or may have the form of one or more signals.
  • Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Physics & Mathematics (AREA)
  • Software Systems (AREA)
  • Physics & Mathematics (AREA)
  • Multimedia (AREA)
  • Technology Law (AREA)
  • Virology (AREA)
  • General Health & Medical Sciences (AREA)
  • Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本发明公开一种数据流量控制的外接式终端防护设备及相应的防护系统，其中所述外接式终端防护设备包括：接口控制模块，用于提供多个数据接口，分别连接被保护主机及一个或多个外部设备；系统控制模块，用于实时监测所述接口控制模块中各个数据接口的数据传输状态，并对各个数据接口的数据进行流量控制。本发明无需在被保护主机上安装流量监控和安全防护软件即可达到对各类型的数据流量进行协议过滤和审计的功能，进而实现低延迟网络审计与高可靠性协议过滤的效果，全面解决了由各个接口可能产生的病毒木马植入以及流量异常等安全隐患。

Description

一种数据流量控制的外接式终端防护设备及防护系统 技术领域
本发明属于计算机安全技术领域，尤其涉及一种数据流量控制的外接式终端防护设备及相应的防护系统。
背景技术
近些年，计算机及网络技术获得高速发展，从而大大促进了网络的普及，当人们日益享受这网络流量带来的便利的同时，也为生产/生活中人们所使用的计算机中的数据流量安全带来了新的威胁，例如常见的有流量攻击、黑客窃取、非授权访问、冒充合法用户、破坏数据完整性、干扰系统正常运行、利用网络传播病毒和中间人窃听等等。
解决内网计算机网络流量管控和信息安全问题的技术手段已有很多，例如在主机中安装和使用流量控制软件、防火墙、防病毒、入侵检测系统等网络安全产品，但采取上述措施后各种网络安全事件仍频频发生。据统计，计算机犯罪的70％是由内部人员非法使用主机等关键资源造成的，真正来自外部的威胁只有30％，内部人员在使用主机时缺乏安全意识，又位于防火墙后端，接入各种外部设备不规范，被植入木马后门，从而导致数据流量异常甚至网络瘫痪，以及系统的误操作或者蓄意的破坏，都会对机关、企事业单位等造成恶劣的影响甚至重大损失。
同时，对于某些特殊设备，如配备有特殊软件控制的主机，某些工业领域的工程师站/工作员站的设备，这些主机/设备往往由于系统特殊性，市面上没有此类系统适配的网络流量控制软件和安全防护软件，或是由于安装流量控制软件或安全类软件容易导致主机原有软件出现兼容性问题，甚至性能受到影响。另外这些工程师站/工作员站的主机上线后基本不会对操作系统进行升级，即使安装流量监控及安全类软件后也往往不及时更新防恶意代码软件版本和恶意代码库，起不到全面的流量控制、网络数据过滤/审计和安全防护作用。
发明内容
基于此，本发明提供一种解决上述问题的一种用于数据流量控制的外接式终端防护设备及防护系统，以实现对被保护主机的各个接口的接管，确保使用被保护主机的USB接口或串口设备必须通过外接式终端防护设备完成，从而无需在被保护主机上安装安全防护软件即可到达对被保护主机USB接口或串口进行防护的目的。
第一方面，本申请提供一种用于数据流量控制的外接式终端防护设备，其包括：接口控制模块，用于提供多个数据接口分别连接被保护主机及一个或多个外部设备；系统控制板，用于实时监测所述接口控制模块中各个数据接口的数据传输状态，并对各个数据接口的数据进行流量控制。
可选地，所述用于数据流量控制的外接式终端防护设备其外接于所述被保护主机上，并将所述接口控制模块与被保护主机的各个数据接口按照类型对应连接。
可选地，所述接口控制模块的多个数据接口进一步包括对内接口、对外接口，以及转发接口；所述对内接口用于与被保护主机的各个数据接口按照接口类型对应连接；所述对外接口用于接入一个或多个外部设备，所述外部设备适于通过所述外接式终端防护设备与被保护主机进行数据交互；所述转发接口用于将各接口类型的数据流量转发给所述系统控制模块。
可选地，所述接口控制模块中进一步包含硬件控制逻辑，用于实现接口控制模块内部各个接口之间物理线路的通断。
可选地，所述系统控制模块进一步包括对外部设备的安全鉴权，以确认所述外部设备是否为许可接入设备。
可选地，当所述系统控制模块对外部设备的安全鉴权后，确认所述外部设备不是许可接入设备时，通过总线通知接口控制模块禁止所述外部设备的数据传输；所述接口控制模块中的硬件控制逻辑保持断开所述 外部设备接入的对外接口与转发接口的物理线路的状态，从而对所述外部设备接入后的数据传输进行过滤禁止。
可选地，当所述系统控制模块对外部设备的安全鉴权后，确认所述外部设备为许可接入设备时，通过总线通知接口控制模块允许所述外部设备的数据传输；所述接口控制模块中的硬件控制逻辑连通所述外部设备接入的对外接口与转发接口的物理线路。
可选地，所述数据接口进一步包括一个或多个网络接口；所述接口控制模块中进一步包含交换芯片，用于获取各个网络接口的寄存器状态，设置接口控制模块的工作模式；所述系统控制模块监测所述交换芯片中网络接口寄存器状态，从而实时获得接口控制模块中各网络接口的连接状态。
可选地，当所述系统控制模块监测到存在一个或多个网络接口的连接状态发生变化时，对相应网络接口状态变化发出告警提示。
可选地，所述系统控制模块通过所述交换芯片设置接口控制模块为流量镜像模式，通过所述接口控制模块中的转发接口，对所述接口控制模块中的对内接口和/或对外接口做流量镜像。
可选地，所述系统控制模块通过所述交换芯片设置接口控制模块为网络协议过滤模式，通过所述接口控制模块中的转发接口，对所述接口控制模块中的对内接口和对外接口之间的数据流量做网络协议过滤。
可选地，所述系统控制模块进一步设定有安全策略，对通过所述接口控制模块接入的外部设备传输进来的数据进行安全性检测；所述接口控制模块将通过安全策略过滤后的数据流量转发给所述被保护主机。
可选地，所述系统控制模块可以是基于ARM或x86的控制模块。
第二方面，本申请提供一种用于数据流量控制的防护系统，包括：
一个或多个外部设备，所述外部设备适于通过所述外接式终端防护设备与被保护主机进行数据交互；
被保护主机；以及
如上所述的外接式终端防护设备，
其中，所述外接式终端防护设备外接于所述被保护主机上，使得所 述一个或多个外部设备通过所述外接式终端防护设备与所述被保护主机进行接口通信。
通过本发明上述技术方案，至少具有如下一种或多种技术效果：可以实现对被保护主机各个数据接口的接管，确保使用被保护主机各个接口的数据通信都通过外接式的终端完成，从而无需在被保护主机上安装流量监控和安全防护软件即可达到对被保护主机各个类型的数据流量进行协议过滤和审计的功能，进而实现低延迟网络审计与高可靠性协议过滤的效果，同时进一步起到安全防护的目的，并且极大降低了整体系统的网络安全风险，全面解决了由各个接口可能产生的病毒木马植入以及流量异常等安全隐患。
附图说明
图1为本发明涉及的用于数据流量控制的防护系统的应用场景；
图2为本发明涉及的外接式终端防护设备内部构造示意图；
图3为本发明涉及的外接式终端防护设备的USB数据流量控制的实施例；
图4为本发明涉及的外接式终端防护设备的串口数据流量控制的实施例；
图5为本发明涉及的外接式终端防护设备的网络数据流量控制实施例；
图6为本发明涉及的用于数据流量控制的防护系统的网络部署实施例。
具体实施方式
下面将参照附图更详细地描述本公开的示例性实施例。虽然附图中显示了本公开的示例性实施例，然而应当理解，可以以各种形式实现本公开而不应被这里阐述的实施例所限制。相反，提供这些实施例是为了 能够更透彻地理解本公开，并且能够将本公开的范围完整的传达给本领域的技术人员。
本文中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外，本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
本发明提出的数据流量控制的外接式终端防护设备包括接口控制模块和系统控制模块。接口控制模块用于提供多个数据接口分别连接被保护主机及一个或多个外部设备。系统控制模块，用于实时监测所述接口控制模块中各个数据接口的数据传输状态，并对各个数据接口的数据进行流量控制。可见，本发明提供了一种硬件方式的终端防护设备，无需在被保护主机上安装流量监控和安全防护软件即可达到对各类型的数据流量进行协议过滤和审计的功能，进而实现低延迟网络审计与高可靠性协议过滤的效果，全面解决了由各个接口可能产生的病毒木马植入以及流量异常等安全隐患。
需要注意的是，本发明中所称的“模块”为硬件模块，即由电路、数据处理装置、存储器、缓存器等有形电子元件构成的硬件模块。本发明中的接口控制模块和系统控制模块可以是物理上或功能上独立的元件组合，也可以是物理上或功能上整合在一起的整体元件组合。例如，作为一种实施方式，接口控制模块由接口控制板构成，系统控制模块由系统控制板构成，接口控制板和系统控制板均为集成有电子元件的电路板，二者之间通过总线连接。而在其他的实施方式中，接口控制模块和系统控制模块亦可以集成在一个电路板上。因此，本发明的关键在于接口控制模块和系统控制模块之间的控制关系，但不限于组成各自模块的电子元件在空间上或物理连接上的组合方式。
实施例
图1所示为本发明涉及的数据流量控制的防护系统的一个实施例的 应用场景。
如图1所示，为了对被保护主机的各个数据流量进行控制，需要对被保护主机各个接口进行接管，由此本发明的外接式终端防护设备上设置有与被保护主机各个接口类型对应的对内接口，同时另外还提供类型相应的对外接口，各对内接口用于连接被保护主机，对外接口用于连接需要与被保护主机进行数据交互的外部设备。所述终端防护设备外接于被保护主机上，将需要防护的被保护主机上各个接口(如USB口的UC1、UC2，COM口的CC0、网口EC0)通过各种类型的连接线连接到自身对应类型的对内接口上，比如将被保护主机的接口UC1与UC2分别连接到外接式终端防护设备的对内USB口UA4和UA3上，将串口CC0连接到对内串口CA2上，网口EC0连接到对内网口EA2上。而各种外部设备(U盘、光驱、串口连接设备等)全部接到所述外接式终端防护设备上各外部接口上，通过外接式终端防护设备才能与被保护主机进行数据通信，从而实现外部设备与被保护主机之间数据流量的控制，比如外部U盘设备通过所述外接式终端防护设备的对外接口UA1接入，USB光驱通过对外接口UA2接入，串口连接设备通过对外接口CA1接入。U盘、USB光驱以及串口连接设备这些外部设备需要与被保护主机进行数据通信，都不能直接接入到被保护主机上，必须通过所述外接式终端防护设备相应的对外接口转接通信。
这样，经由外部设备传输的数据，需要首先经过外接式终端防护设备的数据流量控制，从而可以对数据传输进行协议过滤、流量镜像、流量审计及安全性检测等控制。
图2所示为本发明的外接式终端防护设备内部构造的实施例。
该实施例中，所述外接式终端防护设备主要由接口控制板A和系统控制板B构成，接口控制板A支持USB、串口及网络通信，其与系统控制板B之间通过控制连接线E连接(例如总线)，用于控制接口控制板A上各个接口，比如USB接口、串口及网口的不同工作模式，进而实现对各种外部设备的接入进行安全控制的功能。系统控制板A可实现对各个接口的工作模式控制，工作模式包括可用、不可用、网络协议过 滤、流量镜像或流量审计等，但本发明不限于具体的工作模式控制类型。系统控制板B可通过I2C或SPI接口与接口控制板A相连，但本发明不限于此类具体的控制连接接口。接口控制板通过各个类型的转发接口(数据连接F中的串口、网口、USB等)将对外接口和对内接口中传输的数据流量转发给系统控制板。
所述外接式终端防护设备中的接口控制板还可接入内部存储器，如图2中硬件存储D，用于转存所述接口控制板上各接口间交换的数据。
当有外部设备通过接口控制板上各种类型的对外接口接入时，系统控制板按照设定的安全策略对接口控制板上不同类型的接口进行安全鉴权，以确认所述外部设备是否为许可接入设备。
在此实施例中，外接式终端防护设备所实现的的安全功能包括但不限于，管理员预先对外接式终端防护设备进行权限设置和安全策略设定；安全策略包括但不限于：使能数据导入(如USB接口)、使能数据导出(如USB接口)、USB接入设备限制(如基于USB设备的Vendor ID，即供应商识别码，和/或Product ID，即产品识别码)、数据导入杀毒策略、数据导出黑白名单控制策略、数据导出格式控制策略、使能串口接入策略、USB接口插入保护、使能网络通信审计、使能防火墙功能、设置串口命令黑白名单等。
在一种优选的实施方式中，安全策略包括：管理员在设定好各个安全策略后，相关的这些安全策略将被所述外接式终端防护设备逐一执行。
在一种优选的实施方式中，安全策略包括：管理员还控制所述外接式终端防护设备是否进入监控保护模式，此模式将监控与被保护主机间的连接，异常情况下将进行告警。
在一种优选的实施方式中，安全策略包括：当需要记录异常告警或接口访问情况以备后续管理员查询时，内部存储器还用于进一步记录所述告警信息或接口访问日志信息。
在一种优选的实施方式中，所述接口控制板进一步包含硬件控制逻辑，用于实现接口控制板内部各个接口之间物理线路的通断。当所述系统控制板通过安全策略对外部设备进行安全鉴权后，确认所述外部设备 不是许可接入设备时，通过总线通知接口控制板中的硬件控制逻辑保持断开所述外部设备接入的对外接口与转发接口的物理线路的状态，从而对所述外部设备接入后的数据传输进行过滤禁止。当所述系统控制板对外部设备的安全鉴权后，确认所述外部设备为许可接入设备时，通过总线通知接口控制板允许所述外部设备的数据传输；所述接口控制板中的硬件控制逻辑连通所述外部设备接入的对外接口与转发接口的物理线路。
图3所示，本发明所涉及的外接式终端防护设备内部一种USB数据流量控制的实施例。
接口控制板进一步包含硬件控制逻辑，用于实现接口控制板内部各个接口之间物理线路的通断。接口控制板的对内USB接口UA3与被保护主机的USB口连接，转发接口UB1、UB2分别接入系统控制板的USB接口UD3和UD4，对外USB接口UA1插入待接入的外部设备U盘或移动存储介质，UB3插入用于转存数据的内部USB存储，CTRL口作为总线接口连接系统控制板的控制接口。
当外部设备U盘中的数据需要导入到被保护主机时，系统控制板通过总线传输控制指令通知接口控制板，以控制所述硬件控制逻辑连通UA1与UB1之间的物理线路，将U盘中的数据Data1拷入系统控制板的缓存中，在此期间硬件控制逻辑保持转发接口UB1(与系统控制板连接)与UB3(与内部USB存储连接)的物理线路处于断开状态，同时保持对内USB接口UA3(与被保护主机连接)与UB3的物理线路处于断开状态。
硬件控制逻辑之后断开UA1与UB1之间物理线路的开关，接通UB1与UB3之间的物理线路，将UB3内部USB存储的数据接入UB1接口，系统控制板对缓存中的数据Data1进行安全性检测，实现在被保护主机隔离状态下，系统控制板对UA1插入的USB存储进行杀毒等安全性检测。当Data1通过安全性检测后，将数据Data1拷贝到接口控制板UB3接口的内部USB存储中，期间硬件控制逻辑控制UA1与UB1、UA3与UB3之间的物理连接处于断开状态。之后，硬件控制逻辑断开UB1与 UB3之间的物理连接，控制UA3与UB3的物理线路连通，将UB3接口上内部USB存储中的数据Data1通过对内接口UA3口发送给被保护主机，期间硬件控制逻辑断开UA1与UB1、UB1与UB3的物理线路。
相应的，当被保护主机中数据需要导出到外部设备U盘中时，系统控制板通过总线传输控制指令通知接口控制板，以控制所述硬件控制逻辑控制对内接口UA3与UB3的物理线路连接，UB3接口上内部USB存储将与被保护主机数据连通，用户操作被保护主机B将数据Data2导入所述内部USB存储中，期间硬件控制逻辑保持对外接口UA1与转发接口UB1、UB1与UB3之间的物理线路处于断开状态。之后，硬件控制逻辑断开UA3与UB3之间的物理线路，接通UB1与UB3之间的物理线路，将UB3接口上内部USB存储中的数据Data2通过转发接口UB1转发给系统控制板的缓存，系统控制板对缓存中的数据Data2进行合规性检查，确认导出数据是否符合设定的合规策略，期间硬件控制逻辑保持对外接口UA1与转发接口UB1、对内接口UA3与UB3之间的物理线路连接处于断开状态。当确认导出数据Data2通过合规性检查后，硬件控制逻辑连通对外接口UA1与转发接口UB1之间的物理线路，将数据Data2拷入UA1接口的外部设备U盘中，期间硬件控制逻辑保持转发接口UB1与UB3、对内接口UA3与UB3之间物理线路处于断开状态。至此，完成数据导出过程。
通过本实施例中终端防护设备的数据导入导出的过程经硬件控制逻辑的控制，在任意时刻，只接通一处连接，其他连接处于物理线路断开状态，保证了外部设备接入后与被保护主机之间的数据单向/双向传输全部进行数据流量过滤禁止控制。
图3所示的又一实施例中，终端防护设备还可提供一种非存储类USB设备直连控制，主要针对一些需要直接接入且非存储类的USB设备，例如USB光驱，加密狗等。与上述数据导入导出控制类似，设备直连控制通过系统控制板控制接口控制板的硬件控制逻辑实现对USB设备的数据流量的控制，硬件连线情况如下：终端防护设备中的接口控制板的对内USB接口UA4连接被保护主机的USB接口，转发接口UB2 接入系统控制板的USB接口，对外USB接口UA2插入需直连被保护主机B的外部设备(比如USB光驱)，接口控制板的CTRL口接入总线连接系统控制板的控制接口。
本实施例中所述终端防护设备对USB设备直连控制方法如下：当终端防护设备的对外USB接口UA2插入需直连被保护主机B的外部设备(比如USB光驱)时，接口控制板通过总线通知系统控制板，系统控制板控制接口控制板的硬件控制逻辑接通接口UA2与转发接口UB2的物理线路，使得UA2接口上插入的USB光驱与系统控制板的USB接口连通，在此期间硬件控制逻辑保持接口UA2与连接被保护主机的对内接口UA4的物理线路处于断开状态。
系统控制板对UA2接口上的USB光驱进行安全鉴权，确认此外部设备是否为许可接入设备，当确认此USB光驱是许可接入设备后，硬件控制逻辑将对外接口UA2与对内接口UA4的物理线路接通，实现UA2接口上插入的USB光驱与被保护主机的连接。
当所述系统控制板监测到存在一个或多个接口的连接状态发生变化时，硬件控制逻辑自动断开所述接口与其他接口的物理线路。例如UA2接口上插入的外部设备接入UA4接口期间，系统控制板将实时监测接口控制板的UA2插入的外部设备连接情况，一旦检测到外部设备拔出接口将自动断开连接。
参见图4，本发明所涉及的外接式终端防护设备内部一种串口数据流量控制实施例，可实现对串口通信数据的过滤及禁止某些非法命令输入。系统控制板通过总线通知接口控制板的硬件控制逻辑控制对外串行接口CA1与转发接口CB1、对内串行接口CA2与转发接口CB2之间物理线路的断开与连通。接入对外串行接口CA1的外部设备首先需要通过系统控制板的安全鉴权，之后串口CD1和CD2实现数据互通，接口控制板的硬件控制逻辑接通串口CA1与CB1、CA2与CB2之间的物理线路，从而实现数据从对外串行接口CA1上的外部串口设备到对内串行接口CA2，进而再到被保护主机间的数据通信。
进一步地，系统控制板通过硬件控制逻辑断开CA1与CB1、CA2 与CB2之间的物理连接，实现对CA1与CA2之间串口通信的线路切断。由于CA1与CA2间通信均通过CB1与CB2进行转发，系统控制板可对串口通信数据进行过滤及禁止某些非法命令输入。
参见图5，本发明所涉及的外接式终端防护设备内部一种网络数据流量控制实施例。本实施例中终端防护设备依赖于交换芯片，尤其是专用网络交换芯片，进而实现网络数据流量控制及审计功能。具体地，在所述终端防护设备中的接口控制板上集成了交换芯片，用于获取各个数据接口的寄存器状态，设置接口控制板的工作模式。接口控制板通过总线(即图示控制线)与系统控制板连接，系统控制板的网口E5与接口控制板的转发接口网口E4相连。进一步地，本实施例的所述终端防护设备可以采用专用网络交换芯片，在不影响网络延迟的情况下，支持网络流量镜像审计及网络协议过滤的功能。
由于终端防护设备应用于对网络延迟有较高要求的场合，要求接入网络设备对现有网络延迟、结构无明显影响，且对部署方式要求较为灵活。本方案所述终端防护设备网络审计防火墙设计通过依托于专用硬件实现网络数据流控制，进而实现低延迟网络审计与高可靠性协议过滤。
图5所示的另一实施例中，所述终端防护设备可具备网线防拔出功能，系统控制板通过读取交换芯片网口寄存器状态，从而获得对外网络接口E1与对内网络接口E2的连接状态，连接状态描述为链路连接失败/成功。系统控制板通过监测E1/E2网口连接状态，获得网口状态信息，进而实现对网线插入或拔出情况的告警。
图5所示的又一实施例中，所述终端防护设备可具备网络审计功能。对外接口E1接入局域网或工业控制网络，对内接口E2连接被保护主机B的网口。所述系统控制板基于本地操作指令或远程控制中心的远程网络控制指令，通过交换芯片设置接口控制板为流量镜像模式，通过所述接口控制板中的转发接口E4，对所述接口控制板中的网络接口E1与E2做流量镜像。由此网口E4可获得来自E1及E2两个网口间的网络通信数据，而不影响E1与E2间数据通信，进而可以实现对被保护主机B与外部局域网或工业控制网络之间的网络流量审计。同时，此种方式采用 交换芯片设置接口控制板的工作模式，无需改变网络拓扑或添加额外的网络设备。
图5所示的再一实施例中，所述终端防护设备可具备网络协议过滤功能。所述系统控制板基于本地操作指令或远程控制中心的远程网络控制指令，通过交换芯片设置接口控制板为网络协议过滤模式，通过所述接口控制板中的转发接口E4，对所述接口控制板中的对外接口E1和对内接口E2之间的数据流量做网络协议过滤，从而实现对被保护主机B与外部局域网或工业控制以太网络的数据流量做网络协议过滤。
进一步地，系统控制板可以控制交换芯片切换接口控制板的网口工作模式，比如将网络接口E4的流量镜像模式切换为网络协议过滤模式，或者将网络接口E4的网络协议过滤模式切换为流量镜像模式，或者其他工作模式之间进行切换。
图6为本发明的防护系统的一种网络部署实施例。所述防护系统包括一个或多个外部设备；被保护主机；以及外接式终端防护设备，其中，所述外接式终端防护设备外接于所述被保护主机上，使得所述一个或多个外部设备通过所述外接式终端防护设备与所述被保护主机进行接口通信。在此，所述外接式终端防护设备如上所述，此不再赘述。
进一步地，所述防护系统还包括其远程控制所述外接式终端防护设备的控制中心，控制中心由服务器、管理工作站，以及其他节点所组成，通过网络交换节点连接到所述外接式终端防护设备的网口EA1上。
在此处所提供的说明书中，说明了大量具体细节。然而，能够理解，本发明的实施例可以在没有这些具体细节的情况下实践。在一些实例中，并未详细示出公知的方法、结构和技术，以便不模糊对本说明书的理解。
类似地，应当理解，为了精简本公开并帮助理解各个发明方面中的一个或多个，在上面对本发明的示例性实施例的描述中，本发明的各个特征有时被一起分组到单个实施例、图、或者对其的描述中。然而，并不应将该公开的方法解释成反映如下意图：即所要求保护的本发明要求比在每个权利要求中所明确记载的特征更多的特征。更确切地说，如下面的权利要求书所反映的那样，发明方面在于少于前面公开的单个实施 例的所有特征。因此，遵循具体实施方式的权利要求书由此明确地并入该具体实施方式，其中每个权利要求本身都作为本发明的单独实施例。
本领域那些技术人员可以理解，可以对实施例中的设备中的模块进行自适应性地改变并且把它们设置在与该实施例不同的一个或多个设备中。可以把实施例中的模块或单元或组件组合成一个模块或单元或组件，以及此外可以把它们分成多个子模块或子单元或子组件。除了这样的特征和/或过程或者单元中的至少一些是相互排斥之外，可以采用任何组合对本说明书(包括伴随的权利要求、摘要和附图)中公开的所有特征以及如此公开的任何方法或者设备的所有过程或单元进行组合。除非另外明确陈述，本说明书(包括伴随的权利要求、摘要和附图)中公开的每个特征可以由提供相同、等同或相似目的替代特征来代替。
此外，本领域的技术人员能够理解，尽管在此所述的一些实施例包括其它实施例中所包括的某些特征而不是其它特征，但是不同实施例的特征的组合意味着处于本发明的范围之内并且形成不同的实施例。例如，在下面的权利要求书中，所要求保护的实施例的任意之一都可以以任意的组合方式来使用。
本发明的各个部件实施例可以以硬件实现，或者以在一个或者多个处理器上运行的软件模块实现，或者以它们的组合实现。本领域的技术人员应当理解，可以在实践中使用微处理器或者数字信号处理器(DSP)来实现根据本发明实施例的文字内容的拍照录入装置、计算设备和计算机可读存储介质中的一些或者全部部件的一些或者全部功能。本发明还可以实现为用于执行这里所描述的方法的一部分或者全部的设备或者装置程序(例如，计算机程序和计算机程序产品)。这样的实现本发明的程序可以存储在计算机可读介质上，或者可以具有一个或者多个信号的形式。这样的信号可以从因特网网站上下载得到，或者在载体信号上提供，或者以任何其他形式提供。

Claims (13)

  1. 一种数据流量控制的外接式终端防护设备，其包括：
    接口控制模块，用于提供多个数据接口分别连接被保护主机及一个或多个外部设备；
    系统控制模块，用于实时监测所述接口控制模块中各个数据接口的数据传输状态，并对各个数据接口的数据进行流量控制。
  2. 如权利要求1所述的外接式终端防护设备，其中，
    所述接口控制模块与被保护主机的各个数据接口按照类型对应连接。
  3. 如权利要求2所述的外接式终端防护设备，其中，
    所述接口控制模块的多个数据接口进一步包括对内接口、对外接口，以及转发接口；
    所述对内接口用于与被保护主机的各个数据接口按照接口类型对应连接；
    所述对外接口用于接入一个或多个外部设备，所述外部设备适于通过所述外接式终端防护设备与被保护主机进行数据交互；
    所述转发接口用于将各接口类型的数据流量转发给所述系统控制模块。
  4. 如权利要求3所述的外接式终端防护设备，其中，
    所述接口控制模块中进一步包含硬件控制逻辑，用于实现接口控制模块内部各个接口之间物理线路的通断。
  5. 如权利要求1-4任一项所述的外接式终端防护设备，其中，
    所述系统控制模块进一步包括对外部设备的安全鉴权，以确认所述外部设备是否为许可接入设备。
  6. 如权利要求5所述的外接式终端防护设备，其中，
    当所述系统控制模块对外部设备的安全鉴权后，确认所述外部设备不是许可接入设备时，通过总线通知接口控制模块禁止所述外部设备的数据传输；
    所述接口控制模块中的硬件控制逻辑保持断开所述外部设备接入的对外接口与转发接口的物理线路的状态，从而对所述外部设备接入后的数据传输进行过滤禁止。
  7. 如权利要求5所述的外接式终端防护设备，其中，
    当所述系统控制模块对外部设备的安全鉴权后，确认所述外部设备为许可接入设备时，通过总线通知接口控制模块允许所述外部设备的数据传输；
    所述接口控制模块中的硬件控制逻辑连通所述外部设备接入的对外接口与转发接口的物理线路。
  8. 如权利要求4所述的外接式终端防护设备，其中，
    所述数据接口进一步包括一个或多个网络接口；
    所述接口控制模块中进一步包含交换芯片，用于获取各个网络接口的寄存器状态，设置接口控制模块的工作模式；
    所述系统控制模块监测所述交换芯片中网络接口寄存器状态，从而实时获得接口控制模块中各网络接口的连接状态。
  9. 如权利要求8所述的外接式终端防护设备，其中，
    当所述系统控制模块监测到存在一个或多个网络接口的连接状态发生变化时，对相应网络接口状态变化发出告警提示。
  10. 如权利要求8所述的外接式终端防护设备，其中，
    所述系统控制模块通过所述交换芯片设置接口控制模块为流量镜像模式，通过所述接口控制模块中的转发接口，对所述接口控制模块中的对内接口和/或对外接口做流量镜像。
  11. 如权利要求8所述的外接式终端防护设备，其中，
    所述系统控制模块通过所述交换芯片设置接口控制模块为网络协议过滤模式，通过所述接口控制模块中的转发接口，对所述接口控制模块中的对内接口和对外接口之间的数据流量做网络协议过滤。
  12. 如权利要求8所述的外接式终端防护设备，其中，
    所述系统控制模块进一步设定有安全策略，对通过所述接口控制模块接入的外部设备传输进来的数据进行安全性检测；
    所述接口控制模块将通过安全策略过滤后的数据流量转发给所述被保护主机。
  13. 一种用于数据流量控制的防护系统，包括：
    一个或多个外部设备，所述外部设备适于通过所述外接式终端防护设备与被保护主机进行数据交互；
    被保护主机；以及
    如权利要求1-12任一项所述的外接式终端防护设备，
    其中，所述外接式终端防护设备外接于所述被保护主机上，使得所述一个或多个外部设备通过所述外接式终端防护设备与所述被保护主机进行接口通信。
PCT/CN2019/072030 2018-10-29 2019-01-16 一种数据流量控制的外接式终端防护设备及防护系统 WO2020087782A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US16/978,774 US11170133B2 (en) 2018-10-29 2019-01-16 External terminal protection device and protection system for data flow control

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811264762.7A CN109561071B (zh) 2018-10-29 2018-10-29 一种数据流量控制的外接式终端防护设备及防护系统
CN201811264762.7 2018-10-29

Publications (1)

Publication Number Publication Date
WO2020087782A1 true WO2020087782A1 (zh) 2020-05-07

Family

ID=65865320

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/072030 WO2020087782A1 (zh) 2018-10-29 2019-01-16 一种数据流量控制的外接式终端防护设备及防护系统

Country Status (3)

Country Link
US (1) US11170133B2 (zh)
CN (1) CN109561071B (zh)
WO (1) WO2020087782A1 (zh)

Families Citing this family (12)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109561071B (zh) * 2018-10-29 2020-07-07 北京博衍思创信息科技有限公司 一种数据流量控制的外接式终端防护设备及防护系统
CN111835680A (zh) * 2019-04-18 2020-10-27 四川卫鼎新科信息技术有限公司 一种工业自动制造的安全防护系统
CN110188579A (zh) * 2019-05-29 2019-08-30 成都卫士通信息产业股份有限公司 一种端口安全防护设备及端口安全防护系统
CN110855657B (zh) * 2019-11-07 2021-05-18 深圳市高德信通信股份有限公司 一种计算机网络用的网络安全控制系统
CN111859453A (zh) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 外接式防护设备的文件安全防护方法及外接式防护设备
CN111859344A (zh) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 包括人脸信息验证的外接式终端防护设备及防护系统
CN111898167A (zh) * 2020-07-28 2020-11-06 北京中科麒麟信息工程有限责任公司 包括身份信息验证的外接式终端防护设备及防护系统
CN111898105A (zh) * 2020-07-28 2020-11-06 北京中科麒麟信息工程有限责任公司 具有用户追溯功能的外接式终端防护设备及防护系统
CN111859434A (zh) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 一种提供保密文件传输的外接式终端防护设备及防护系统
CN111885179B (zh) * 2020-07-28 2022-05-10 北京中科麒麟信息工程有限责任公司 一种基于文件监测服务的外接式终端防护设备及防护系统
CN111859473A (zh) * 2020-07-28 2020-10-30 北京中科麒麟信息工程有限责任公司 基于空间检测的外接式终端防护设备及防护系统
BR102021010255A2 (pt) * 2021-05-27 2021-09-28 Strong Rock Ltda Dispositivo autônomo de backup e sistema autônomo de backup

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012106049A1 (en) * 2011-02-01 2012-08-09 Mcci Corporation Security arrangements for extended usb protocol stack of a usb host system
CN103020546A (zh) * 2012-12-18 2013-04-03 广州市华标科技发展有限公司 智能物理隔离安全数据交换设备及方法
CN103778388A (zh) * 2013-01-05 2014-05-07 天津七所精密机电技术有限公司 一种安全增强计算机系统
CN104915597A (zh) * 2015-05-19 2015-09-16 王晓楠 一种物理隔离式usb接口防护系统及其防护方法
CN205210890U (zh) * 2015-12-20 2016-05-04 任剑岚 新型计算机互联网信息安全控制系统

Family Cites Families (52)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5889776A (en) * 1997-01-31 1999-03-30 Alpnet Corporation Physical layer switch system for ethernet local area network communication system
US6301815B1 (en) * 1999-03-04 2001-10-16 Colt's Manufacturing Company, Inc. Firearms and docking station system for limiting use of firearm
US6886104B1 (en) * 1999-06-25 2005-04-26 Cross Match Technologies Rechargeable mobile hand-held fingerprint scanner with a data and power communication interface
US20030198015A1 (en) * 2002-04-19 2003-10-23 Edwin Vogt Mobile docking station
US20040064631A1 (en) * 2002-06-03 2004-04-01 Viewsonic Corporation Pixel vault
US7644177B2 (en) * 2003-02-28 2010-01-05 Cisco Technology, Inc. Multicast-routing-protocol-independent realization of IP multicast forwarding
US7313725B2 (en) * 2003-07-29 2007-12-25 Gateway Inc. Replacement restoration disk drive and method
US7490350B1 (en) * 2004-03-12 2009-02-10 Sca Technica, Inc. Achieving high assurance connectivity on computing devices and defeating blended hacking attacks
US9436820B1 (en) * 2004-08-02 2016-09-06 Cisco Technology, Inc. Controlling access to resources in a network
WO2006026054A1 (en) * 2004-08-27 2006-03-09 Thomson Licensing Apparatus and method for enabling digital and analog data communication over a data bus
US20060072241A1 (en) * 2004-09-30 2006-04-06 Feliss Norbert A System, method, and apparatus for a wireless hard disk drive
US8407763B2 (en) * 2006-04-28 2013-03-26 Bae Systems Information And Electronic Systems Integration Inc. Secure network interface device
US9100325B2 (en) * 2008-10-23 2015-08-04 Marvell International Ltd. Controlling a network connection status indicator
US8068419B2 (en) * 2008-11-13 2011-11-29 Jeremy Dujardin System and method for transmitting video, audio, and data content using a fiber optic network
US10536990B1 (en) * 2009-02-03 2020-01-14 Dominic M. Kotab Telephone base station for combining mobile and terrestrial telephone service
CN101520831B (zh) * 2009-03-27 2011-08-24 深圳市永达电子股份有限公司 安全终端系统及终端安全方法
FR2949888B1 (fr) * 2009-09-04 2014-12-26 Thales Sa Dispositif de protection contre les logiciels malveillants et ordinateur comprenant le dispositif.
US8601540B2 (en) * 2009-10-07 2013-12-03 International Business Machines Corporation Software license management
TWM378425U (en) * 2009-10-20 2010-04-11 Io Interconnect Ltd Docking station with image control system
CN101707561B (zh) * 2009-11-06 2012-06-06 中兴通讯股份有限公司 一种基于网络安全的镜像方法及系统
US9299075B2 (en) * 2009-11-19 2016-03-29 Adobe Systems Incorporated Method and system for activating a software application while provisioning services for the application
US10157269B2 (en) * 2010-05-06 2018-12-18 John K. Thomas Verification system for secure transmission in a distributed processing network
EP2605573A4 (en) * 2010-08-13 2015-02-11 Nec Corp WIRELESS COMMUNICATION NETWORK AND METHOD FOR SELECTING THE PATH
US9081911B2 (en) * 2011-05-31 2015-07-14 Architecture Technology Corporation Mediating communication of a universal serial bus device
CA2780393C (en) * 2011-06-21 2016-06-07 Dls Technology Corporation Key based secure operating system with secure dongle and method, and cryptographic method
US9098680B2 (en) * 2011-12-22 2015-08-04 Abbvie Inc. Application security framework
CN102624533B (zh) * 2012-05-02 2014-08-13 广西大学 一种列车车辆级以太网交换装置
US8811008B2 (en) * 2012-06-08 2014-08-19 Bosch Automotive Service Solutions Llc Modular docking station for enclosing mobile devices
CN102929329B (zh) * 2012-09-28 2015-04-08 无锡江南计算技术研究所 片上系统间互连网络的动态重构方法
US8875166B2 (en) * 2012-11-08 2014-10-28 Sharp Laboratories Of America, Inc. Method and cloud security framework for implementing tenant license verification
RU130429U1 (ru) * 2013-04-01 2013-07-20 Общество с ограниченной ответственностью "Инновационно-производственный центр "Нейтральные компьютерные системы" Терминал и защищенная компьютерная система, включающая терминал
US9465947B2 (en) * 2013-08-05 2016-10-11 Samsung Sds America, Inc. System and method for encryption and key management in cloud storage
CN203618018U (zh) * 2013-10-30 2014-05-28 国家信息中心 内外网安全接入终端
CN103532978A (zh) * 2013-10-30 2014-01-22 北京艾斯蒙科技有限公司 内外网安全接入模式
CN103532980A (zh) * 2013-10-30 2014-01-22 国家信息中心 内外网安全接入终端
CN203618020U (zh) * 2013-10-30 2014-05-28 北京艾斯蒙科技有限公司 内外网安全接入模式
KR101468977B1 (ko) * 2014-03-18 2014-12-04 성 탁 문 라파엘 모바일 디바이스를 이용한 인증방법 및 시스템
US9645954B2 (en) * 2014-06-05 2017-05-09 Lenovo (Singapore) Pte. Ltd. Embedded microcontroller and buses
CN105991595B (zh) * 2015-02-15 2020-08-07 华为技术有限公司 网络安全防护方法及装置
US9678507B1 (en) * 2015-06-25 2017-06-13 Latitude Engineering, LLC Autonomous infrastructure element survey systems and methods using UAV fleet deployment
CN106022094A (zh) * 2016-06-29 2016-10-12 国家电网公司 一种可集成于计算机的外网u盘隔离检测仪及检测方法
CN206003099U (zh) * 2016-06-29 2017-03-08 国家电网公司 一种可集成于计算机的外网u盘隔离检测仪
US20180063477A1 (en) * 2016-09-01 2018-03-01 Microsoft Technology Licensing, Llc Tablet docking stations as adapter for video conferencing system
US10321313B2 (en) * 2016-09-09 2019-06-11 Dell Products L.P. Enabling remote access to a service controller having a factory-installed unique default password
US10699013B2 (en) * 2017-03-20 2020-06-30 Honeywell International Inc. Systems and methods for USB/firewire port monitoring, filtering, and security
KR102400745B1 (ko) * 2017-03-28 2022-05-23 삼성전자주식회사 전자 장치용 도킹 스테이션
US10409751B2 (en) * 2017-04-11 2019-09-10 Dell Products, Lp System and method for adding active out-of-band management capability as a user-selectable module
IT201700058961A1 (it) * 2017-05-30 2018-11-30 Artglass S R L Metodo e sistema di fruizione di un contenuto editoriale in un sito preferibilmente culturale o artistico o paesaggistico o naturalistico o fieristico o espositivo
CN107239419B (zh) * 2017-06-08 2020-02-07 山东超越数控电子有限公司 一种在PowerPC DPAA模式下实现网络接口自适应的方法
CN109561071B (zh) * 2018-10-29 2020-07-07 北京博衍思创信息科技有限公司 一种数据流量控制的外接式终端防护设备及防护系统
CN109522760B (zh) * 2018-10-29 2020-08-14 北京博衍思创信息科技有限公司 一种基于硬件控制逻辑的数据转发控制方法及系统
CN109543475B (zh) * 2018-10-29 2020-07-07 北京博衍思创信息科技有限公司 一种外接式终端防护设备及防护系统

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2012106049A1 (en) * 2011-02-01 2012-08-09 Mcci Corporation Security arrangements for extended usb protocol stack of a usb host system
CN103020546A (zh) * 2012-12-18 2013-04-03 广州市华标科技发展有限公司 智能物理隔离安全数据交换设备及方法
CN103778388A (zh) * 2013-01-05 2014-05-07 天津七所精密机电技术有限公司 一种安全增强计算机系统
CN104915597A (zh) * 2015-05-19 2015-09-16 王晓楠 一种物理隔离式usb接口防护系统及其防护方法
CN205210890U (zh) * 2015-12-20 2016-05-04 任剑岚 新型计算机互联网信息安全控制系统

Also Published As

Publication number Publication date
US20200410140A1 (en) 2020-12-31
CN109561071A (zh) 2019-04-02
US11170133B2 (en) 2021-11-09
CN109561071B (zh) 2020-07-07

Similar Documents

Publication Publication Date Title
WO2020087782A1 (zh) 一种数据流量控制的外接式终端防护设备及防护系统
WO2020087781A1 (zh) 一种外接式终端防护设备及防护系统
WO2020087783A1 (zh) 一种基于硬件控制逻辑的数据转发控制方法及系统
US8862803B2 (en) Mediating communciation of a univeral serial bus device
US8869273B2 (en) Apparatus and method for enhancing security of data on a host computing device and a peripheral device
US9380023B2 (en) Enterprise cross-domain solution having configurable data filters
WO2024012135A1 (zh) 基于接口检测的外接式防护设备和方法
CN111901418B (zh) 基于单向文件传输协议的外接式终端防护设备及系统
US20240320379A1 (en) Method, Apparatus and Electronic Device for Controlliing the Communication between USB Device and Protected Device
US9444845B2 (en) Network security apparatus and method
CN111885179B (zh) 一种基于文件监测服务的外接式终端防护设备及防护系统
Sun et al. Analysis and prevention of information security of USB
CN111859434A (zh) 一种提供保密文件传输的外接式终端防护设备及防护系统
RU2822994C2 (ru) Способ управления перемещением данных на основе логического узла аппаратного управления и система для осуществления способа
JP7571934B2 (ja) テレワーク感知によるセキュリティ管理方法及びこれを行うためのコンピュータプログラム
Li et al. A Portable Network Isolation Apparatus for Substation Maintenance Based on Firewall
KR20230132989A (ko) 원격 업무 감지에 따른 보안 관리 방법 및 이를 수행하기 위한 컴퓨터 프로그램
JP2013172249A (ja) 情報制御サーバ及び情報制御方法
JP2003198636A (ja) ネットワークのセキュリティシステム及びそのセキュリティ方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19879328

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 19879328

Country of ref document: EP

Kind code of ref document: A1