基于单向光闸的传输控制系统的设计与实现

发布时间：2018-10-18 19:35

【摘要】：为了实现对办公环境和涉密信息的保护,很多涉密单位往往采用物理隔断的方式。这种物理隔断意味着完全的断开,影响了涉密网络环境中业务信息系统的数据交换和其他业务需要,并且由于可以完成信息交换的载体可能会成为泄密的工具,涉密网络环境的安全问题仍然存在。针对以上问题,本文利用光介质及其传输设备功能单向性特点,采用光纤网卡,分光器等设备,以单向光纤为传输介质,在硬件层面保证单向隔离的基础上建立逻辑传输通道,实现文件数据的单向无反馈传输,防止信息传递过程中泄密现象的发生。本文设计了一种私有传输协议对涉密网络环境进行信息传输控制。私有传输协议可以对传输过程进行管理、控制,中断一切TCP连接,将文件数据利用该协议进行封装和解析。任何网络数据必须落地成文件才能经过单向光闸传输控制系统；结合Libpcap技术与PF_RING技术的优势,设计了基于千兆光纤网卡的高速数据包捕获模块。最后设计了文件同步模块和数据库同步模块,并完成单向传输控制系统的设计实现。对文件同步以及数据库同步功能进行了多组测试,测试结果表明,本系统可以满足涉密网络环境单向传输的需求。
[Abstract]:In order to protect the office environment and secret information, many secret units often use physical partition. This physical partition means complete disconnection, affecting the data exchange and other business needs of business information systems in a confidential network environment, and since carriers that can complete the exchange of information may become a tool for disclosure. Security problems still exist in the secret network environment. In view of the above problems, this paper utilizes the unidirectional characteristics of optical medium and its transmission equipment, adopts optical fiber network card, optical splitter and other equipment, takes unidirectional optical fiber as transmission medium, and establishes logical transmission channel on the basis of hardware level to ensure unidirectional isolation. Realize the one-way non-feedback transmission of file data, and prevent the leakage of information in the process of information transmission. In this paper, a private transport protocol is designed to control the transmission of information in a secret network environment. Private transport protocol can manage, control, interrupt all TCP connections, and encapsulate and parse file data by this protocol. Any network data must be landed as a file to pass through the one-way optical gate transmission control system, combined with the advantages of Libpcap technology and PF_RING technology, a high-speed packet capture module based on gigabit optical fiber network card is designed. Finally, the file synchronization module and the database synchronization module are designed, and the unidirectional transmission control system is designed and implemented. The functions of file synchronization and database synchronization are tested in several groups. The test results show that the system can meet the demand of one-way transmission in secret network environment.
【学位授予单位】：北方工业大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP309;TP273

【相似文献】