CN115766269A - Multi-network isolation gatekeeper exchange unit based on RapidIO - Google Patents

Abstract

The invention belongs to the field of embedded systems, in particular to a RapidIO-based multi-network isolation gatekeeper switching unit, which aims at the problems that the existing isolation gatekeeper only aims at a single internal network and a single external network, can not realize the information exchange in the whole system, and can not meet the requirement of simultaneously isolating a plurality of internal networks and external networks, and provides the following scheme, which comprises a data switching system and four dual-port RAMs; the invention designs a data exchange system by applying RapidIO technology to the exchange unit of the isolation network gate on the basis of the traditional isolation network gate, so that the unit can be combined with the traditional internal and external network processing unit to form a multi-network isolation network gate, the problem that the traditional isolation network gate only aims at a single internal and external network can be solved, the information exchange in the whole system is realized, and the requirement of simultaneously isolating a plurality of internal and external networks is met.

Description

Multi-network isolation network gate exchange unit based on RapidIO

Technical Field

The invention relates to the technical field of embedded systems, in particular to a RapidIO-based multi-network isolation gatekeeper switching unit.

Background

In a real network environment, the situation that a plurality of internal networks are simultaneously connected to an external network often occurs, and great challenge is provided for the traditional isolation gatekeeper which can only carry out safe information exchange on a single internal network and a single external network. Traditional multi-network isolation is mostly protocol isolation based on software strategy, direct or routable physical connection exists between networks, and compared with an isolation network gate, the isolation network gate is not safe enough, and the requirement of mutual safe isolation of a plurality of networks cannot be met. However, building the traditional isolation gatekeepers between networks of different security domains consumes a lot of resources and is difficult to maintain. Therefore, the isolation network gate with the multi-network safety isolation function has a great application prospect. The rapidlnput/Output (RapidIO) bus is a novel packet switching interconnection technology, has the characteristics of high performance, small pin number and the like, is often used for interconnection of modules in an embedded system, supports data transmission between chips and between boards, and can also be used for interconnection of a backboard of the embedded system. Compared with the traditional shared parallel data bus, the RapidIO bus has higher transmission rate, wide application direction, higher extensibility and more flexible topological structure, can reduce the complexity of layout and wiring in the system and can better complete the task of data exchange.

In the prior art, a traditional isolation gatekeeper can only aim at a single internal network and a single external network, cannot realize information exchange inside the whole system, and cannot meet the requirement that a plurality of internal networks and external networks are isolated from each other at the same time, so that a multi-network isolation gatekeeper exchange unit based on RapidIO is provided for solving the problems.

Disclosure of Invention

The invention aims to solve the defects that the traditional isolation gatekeeper only aims at a single internal network and a single external network, can not realize information exchange in the whole system and can not meet the requirement of simultaneously isolating a plurality of internal networks and external networks, and provides a multi-network isolation gatekeeper exchange unit based on RapidIO.

In order to achieve the purpose, the invention adopts the following technical scheme:

a multi-network isolation gateway switching unit based on RapidIO comprises a data switching system and four dual-port RAMs, wherein the data switching system comprises four FPGA processing chips and a RapidIO switch; each FPGA processing chip is connected with a dual-port RAM; and each FPGA processing chip is connected with a RapidIO switch in the data exchange system.

Preferably, the four dual-port RAMs correspond to an intranet and extranet processing unit, and are responsible for caching the original data transmitted from the corresponding processing unit when the isolation gatekeeper operates.

Preferably, four FPGA processing chips are used as system control chips to share the operation load of the whole system, and each FPGA chip is responsible for controlling the reading and writing of the dual-port RAM connected with the FPGA chip and the transceiving of RapidIO bus data.

Preferably, the RapidIO switch chip is connected with other FPGA control chips, and the RapidIO switch chip is used for providing a plurality of RapidIO bus communication ports and a full-connection switching network inside each port, so as to realize point-to-point RapidIO network interconnection among all the FPGA control chips, and is responsible for transmitting a data packet sent by the FPGA control chips to a target FPGA control chip.

Preferably, two groups of GTXs are connected between the FPGA control chip and the RapidIO switching chip so as to further increase transmission channels.

Preferably, two groups of data interaction architectures are configured in the FPGA control chip, and each data interaction architecture comprises a RapidIO IP core, a data sending module, a data receiving module, a maintenance module, a sending end FIFO module, and a receiving end FIFO module.

Preferably, the sending end FIFO module of each group of data interaction architecture is mainly used to buffer half of the data read from the dual-port RAM chip, so as to divide one path of data into two paths of data transmission.

Preferably, the function of the data sending module is to generate and send a RapidIO request transaction, and during data transmission, the sending module sends data to the switch, and also sends the device ID and the destination ID to the switch.

Preferably, the data receiving module is responsible for receiving data, separating out a packet header and carried data, distinguishing whether the received transaction is a stream write transaction, and preparing to write the data into the FIFO module.

Preferably, the receiving-end FIFO module is configured to perform time sequence alignment on the two paths of data to facilitate subsequent merging.

In the invention, the RapidIO-based multi-network isolation gatekeeper switching unit has the beneficial effects that:

this scheme is through on the basis of traditional isolation gatekeeper, is applied to the exchange unit of isolation gatekeeper with RapidIO technique, has designed a data exchange system, makes this unit can combine into a many nets isolation gatekeeper with traditional internal and external network processing unit, can solve traditional isolation gatekeeper and can only be to the problem of single internal and external network, realizes the inside information exchange of entire system, satisfies the demand that a plurality of internal and external networks kept apart mutually simultaneously.

The invention relates to a multi-network isolation gatekeeper, which is designed to meet the requirement of multi-network safety isolation information exchange and solve the problem that the traditional isolation gatekeeper only can aim at a single internal network and a single external network, and a data exchange system is designed in the multi-network isolation gatekeeper, so that the multi-network isolation gatekeeper can be combined with the traditional internal network and external network processing units to form the multi-network isolation gatekeeper, and the safety information exchange is carried out on a plurality of networks. The data exchange system uses the FPGA as RapidIO interconnection equipment to realize high-speed data transmission and exchange, and the equipment is connected through a RapidIO switch. After the board card debugging and verification is carried out on the system, the result shows that the information exchange problem of multi-channel data can be solved through the system, and the internal information exchange rate of the data exchange system can reach 3.4GByte/s under the condition that the number of bytes sent reaches 128KByte, so that the requirement of an actual communication system is met, and the system can be applied to the design of a gigabit and even ten-gigabit multi-network isolation gatekeeper.

Drawings

Fig. 1 is a hardware architecture diagram of a multi-network isolation gatekeeper switching unit based on RapidIO according to the present invention;

fig. 2 is a schematic diagram of a multi-network isolation gatekeeper structure of a multi-network isolation gatekeeper switching unit based on RapidIO according to the present invention;

fig. 3 is an overall FPGA logic block diagram of a multi-network isolation gatekeeper switching unit based on RapidIO according to the present invention;

fig. 4 is a data transmission flow chart of a multi-network isolation gatekeeper switching unit based on RapidIO according to the present invention;

fig. 5 is a data receiving flow chart of a multi-network isolation gatekeeper switching unit based on RapidIO according to the present invention;

FIG. 6 is a schematic diagram of a simple system test model of a RapidIO-based multi-network isolation gatekeeper switching unit according to the present invention;

fig. 7 is a schematic diagram of data transmission by a transmitting end of a RapidIO-based multi-network isolation gatekeeper switching unit according to the present invention;

fig. 8 is a schematic diagram of data received by a receiving end of a multi-network isolation gatekeeper switching unit based on RapidIO according to the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments.

Example one

Referring to fig. 1 and fig. 2, a multi-network isolation gatekeeper switching unit based on RapidIO comprises a data switching system and four dual-port RAMs, wherein the data switching system comprises four FPGA processing chips and a RapidIO switch; each FPGA processing chip is connected with one dual-port RAM; each FPGA processing chip is connected with a RapidIO switch in the data exchange system, and each RAM corresponds to an internal and external network processing unit and is responsible for caching original data transmitted by the corresponding processing unit when the isolation gatekeeper works, so that the requirement that the multi-network isolation gatekeeper is simultaneously accessed into four networks is met. The design can ensure that each RAM only needs to care about data in one direction, the data receiving and transmitting are easier to control, the congestion is reduced, the data receiving and transmitting speed is integrally increased, and the operation load of a control chip is reduced. The FPGA can be programmed and is easy to modify, and the defect that the number of traditional programmable circuit gates is limited is overcome. When a system is designed, a program is required to be continuously modified so as to optimize a system structure, repair bugs and the like. After the system is put into practical use, the configuration of the FPGA can be rewritten according to the practical situation, so that the system uses the FPGA chip as a control chip. However, a single FPGA chip cannot support the designed operation load, so the four FPGA chips share the operation load of the whole system, and each FPGA chip is responsible for controlling the reading and writing of the dual-port RAM connected with the FPGA chip and the receiving and sending of data. In order to realize data exchange between chips in the system, some way needs to be selected to connect the chips. The RapidIO bus belongs to a serial bus, compared with a traditional shared bus, more transmission channels can be added, the transmission speed is greatly improved, the protocol of the latest version can reach the transmission bandwidth of giga or even ten thousand mega, the point-to-point communication mode effectively reduces the burden of a transmission link, breaks through the upper limit of the original clock frequency, and the bus arbitration problem of a parallel bus can not occur, so the transmission efficiency of the system is also very high, and the RapidIO bus technology is selected and used by the system. The FPGA selected by the system is Virtex-7 series of Xilinx, and the model is XC7VX485T-1FFG1157. The chip can use an IP core to simplify the system design difficulty during programming, the RapidIO IP core supports RapidIO 2.2 protocol, and the chip also integrates 5 groups of GTX high-speed serial transceivers and can be used for realizing a physical layer protocol of RapidIO transmission. If the four chips are directly connected through the signal lines to realize data transmission among the chips, more signal lines are consumed, and the design is more difficult. The exchange structure is a cross-bar switch network formed by novel switch devices and packet exchange technology, all point-to-point communication lines of the system are connected together, and therefore free interconnection and concurrent data transmission among all chips or modules can be completed. Therefore, in order to reduce the complexity of layout and wiring, reduce the resource consumption and reduce the design difficulty, the system uses the RapidIO exchange chip to connect other chips. Two groups of GTXs are connected between each FPGA chip and the exchange chip, and the design can enable the FPGA to use more transmission channels to further improve the transmission bandwidth during the design of the end point. The RapidIO exchange chip selected by the system is CPS1432 of IDT company. CPS1432 is a low-latency, 14-port, 32-channel RapidIO switch chip that supports the RapidIO 2.1 protocol. CPS1432 supports port widths of 1x, 2x, and 4x, and may be configured with up to 8 4x ports. The single-channel selectable speeds are 1.25, 2.5, 3.125, 5.0 and 6.25Gb/s. The chip is sufficient to support the design of the present system. The process of realizing data exchange is completed by RapidIO bus technology. The configuration of RapidIO endpoints determines the overall speed of the overall system switch. In order to improve the bandwidth of a data exchange system to the maximum extent, the system introduces the thought of double-channel serial RapidIO, a double-channel data receiving and transmitting technology is designed, original one-channel data is split into two-channel receiving and transmitting, so that the data exchange bandwidth of the system is improved in a breakthrough manner, an exchange unit can be connected with three intranet processing units and one extranet processing unit to form the system, three intranet hosts and one extranet host can be connected simultaneously, and the exchange unit is mainly responsible for controlling the connection with the intranet and extranet processing units and completing the ferrying process of the data to be exchanged. After the intranet processing unit is connected with the exchange unit, the processed original data is transmitted to a data storage in the intranet processing unit, then the physical connection between the intranet processing unit and the exchange unit is disconnected, the data is judged to be transmitted to which processing unit, and then the exchange unit is connected with the corresponding processing unit. And when the internal network transmits data to the external network, ferrying the original data to the external network processing unit.

Referring to fig. 3, the dual-port RAM corresponds to an internal and external network processing unit and is responsible for caching original data transmitted from the corresponding processing unit when the isolation gatekeeper works, each FPGA chip is responsible for controlling reading and writing of the dual-port RAM connected to the FPGA chip and transceiving of RapidIO bus data, in order to transmit one path of data by using two RapidIO interfaces, the system configures 2 identical RapidIO IP cores (two groups of GTX are needed) in one FPGA chip, wherein the linear velocity is 5Gb/s, the link width is 4x, and the clock is 125MHz. The theoretical transmission bandwidth of the system can reach 32Gb/s, namely 4GByte/s. Even if the system cannot reach the theoretical maximum speed in actual operation, the system can still meet the design requirement of a gigabit or even ten gigabit isolation gatekeeper. Because the RapidIO IP core already includes the functions of the physical layer, the transport layer and the logic layer in the RapidIO protocol, the RapidIO endpoint device function can be realized only by correspondingly programming the user interface part of the IP core. The two RapidIO IP core data receiving and sending logics in the FPGA chip used in the design are the same and are composed of a data sending module, a data receiving module, a maintenance module and an FIFO module.

Referring to fig. 4, four FPGA processing chips are used as system control chips to share the operation load of the whole system, each FPGA chip is responsible for controlling the reading and writing of the dual-port RAM connected to the FPGA chip and the transceiving of the RapidIO bus data, and the transmitting-end FIFO module is mainly used for caching the data read from the dual-port RAM chip so as to divide one path of data into two paths of data transmission. The internal logic of the transmitting end FIFO module mainly comprises: and caching the data read from the dual-port RAM, wherein the two FIFOs share one write clock, respectively caching half of the read data, and stopping the write operation after the RAM is empty. The function of the data sending module is to send a packet of a RapidIO request transaction. Considering that the system needs to transmit a large amount of data and does not need to respond to the transaction when working, the streaming write transaction which has higher efficiency and does not generate response is adopted. And during data transmission, the sending module sends the data to the switch and also sends the equipment ID and the destination ID to the switch. The internal logic of the data sending module is mainly as follows: the method comprises the steps of reading data from a FIFO module of a sending end, assembling a packet header according to a flow write transaction, and sequentially sending the packet header and the data according to a RapidIO protocol time sequence, wherein because a single data packet can send 256 bytes of data at most at one time, and the data transmission quantity is usually more than 256 bytes when the system is used, each packet is designed to carry 256 bytes of data, and one-time data transmission is completed by sending a plurality of data packets. The data receiving module is responsible for receiving data, separating out a packet header and carried data, distinguishing whether the received transaction is a stream writing transaction or not, and preparing for writing the data into the FIFO module. Since the streaming write transaction does not require a response, the module does not generate a response transaction.

Referring to fig. 5, the RapidIO switch chip is connected to other FPGA control chips, the RapidIO switch chip is used for providing a plurality of RapidIO bus communication ports and a full-connection switching network inside each port, so as to realize point-to-point RapidIO network interconnection among all the FPGA control chips, and is responsible for transmitting a data packet sent by the FPGA control chip to a target FPGA control chip, and the internal logic of the data receiving module mainly comprises: and receiving data after the resetting is finished, judging whether the data packet is a stream writing transaction according to each field of the stripped data packet header, and if the data packet is the stream writing transaction, writing the data carried by the data packet into a receiving end FIFO module. The receiving end FIFO module is used for aligning and combining two paths of data. The internal logic of the receiving end FIFO module is mainly as follows: and caching the data processed by the data receiving module, stopping FIFO writing operation after the data receiving is finished, and finishing the alignment and combination of the data by using the same shared clock for the read clocks of the two FIFOs. The RapidIO packet, when generated, encapsulates the destination ID and source ID in a packet header. The RapidIO switch chip forwards the data packet entering the switch to the correct output port by means of the routing table. Therefore, each port of the switch chip needs to be configured with a routing table, and the contents of the routing table mainly contain destination ID and output port. After one port receives the input packet, the corresponding output port is searched in the port lookup table through the target ID carried by the port, and the data packet is forwarded to the correct output port, so that the routing of the data packet is completed. By controlling the routing table, two designated ports can not communicate with each other, so that the requirement that any two internal and external networks in multi-network isolation are independent and do not communicate with each other is met. The port configuration of the switch should conform to the endpoint configuration of the RapidIO switching network, so CPS1432 is configured as 8 4x ports according to the user manual. Every two 4x ports correspond to one FPGA chip, the transmission rate of a single channel of all the ports of the CPS1432 is configured to be 5Gb/s, and the configuration of routing tables of all the ports is completed.

Referring to fig. 6, two groups of GTXs are connected between the FPGA control chip and the RapidIO switch chip to further increase transmission channels, the system performs a test by constructing a group of test data to perform one-time transmission and exchange in the data exchange system, two FPGA chips are randomly selected to be used as a transmitting end and a receiving end, and a simple system test model is shown in fig. 6. The specific test flow is as follows: test data which is increased with bytes is constructed in the FPGA1 chip shown in the figure 6 in advance to replace data in the dual-port RAM during actual work, and then the system is started to enable the FPGA1 chip to send the data to the FPGA2 chip through the switch. Adding a counter in the FPGA1, when data is sent, sending a timer signal to the FPGA1, starting timing, adding a counter in the FPGA2 to count the number of transmitted data packets, after a certain amount of data packets are transmitted, sending a stop signal by the FPGA2 by pulling up the I/0 port level connected with the FPGA1, stopping counting by the counter in the FPGA1, then grabbing the signals in the FPGA1 and the FPGA2 by using an ILA tool of Vivado software, checking whether data transmission is correct, observing the value of the counter in the FPGA1, and obtaining the actual system transmission time according to the frequency of the counter.

Referring to fig. 7 and 8, two sets of data interaction architectures are configured in the fpga control chip, and each set of data interaction architecture includes a RapidIO IP core, a data sending module, a data receiving module, a maintenance module, a sending-end FIFO module, and a receiving-end FIFO module, where the sending-end FIFO module of each set of data interaction architecture is mainly used to buffer half of data read from the dual-port RAM chip, so as to divide one path of data into two paths of data transmission, and data of the sending end and the receiving end are as shown in fig. 7 and 8. In fig. 7, datain is test data constructed by the transmitting end, and is a set of data that is incremented by bytes. In fig. 8, dataout is data received by the receiving end, rd _ en is read enable, and when the read enable is valid, the received data is the same as the data sent by the sending end, which proves that the system can correctly transmit the data to a specified chip.

As shown in the following table, the function of the data sending module is to generate and send RapidIO request transactions, when data is transmitted, the sending module sends data to the switch, and also sends the device ID and the destination ID to the switch, the data receiving module is responsible for receiving the data, separating out the packet header and the carried data, distinguishing whether the received transaction is a stream writing transaction, and making preparation for writing the data into the FIFO module, the receiving-end FIFO module is used for performing time sequence alignment on two paths of data to facilitate subsequent combination, and after actual test, the system transmission performance of the system when different data amounts are transmitted is shown in the following table. When the data volume less than 32KByte is transmitted, the transmission bandwidth is increased faster with the increase of the data volume, and when the data volume more than 32KByte is transmitted, the actual transmission bandwidth tends to be stable, and under the condition that the transmitted byte number reaches 128KByte, the actual transmission bandwidth can reach 3.4GByte/s, which is about 85% of the theoretical value. The above tests show that the system can realize the data exchange function of four endpoint devices, and the transmission performance of the system is high, so that the data exchange system can sufficiently meet the high-speed communication requirement of the multi-network isolation gatekeeper.

The above description is only for the preferred embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art should be considered as the technical solutions and the inventive concepts of the present invention within the technical scope of the present invention.

Claims (10)

1. A multi-network isolation gatekeeper exchange unit based on RapidIO comprises a data exchange system and four dual-port RAMs, and is characterized in that the data exchange system comprises four FPGA processing chips and a RapidIO exchanger; each FPGA processing chip is connected with one dual-port RAM; and each FPGA processing chip is connected with a RapidIO switch in the data exchange system.

2. The RapidIO-based multi-network isolation gatekeeper switching unit of claim 1, wherein each of the four dual port RAMs corresponds to an Intranet processing unit and an Intranet processing unit, and is responsible for buffering original data transmitted from the corresponding processing unit when the isolation gatekeeper is operated.

3. The RapidIO-based multi-network isolation gatekeeper switching unit as claimed in claim 2, wherein four FPGA processing chips are used as system control chips to share the operation load of the whole system, and each FPGA chip is responsible for controlling the reading and writing of the dual-port RAM connected with the FPGA chip and the transceiving of RapidIO bus data.

4. The RapidIO-based multi-network isolation gatekeeper switching unit of claim 3, wherein the RapidIO switching chip is connected with other FPGA control chips, and the RapidIO switching chip is used for providing a plurality of RapidIO bus communication ports and all-connection switching networks in each port, realizing point-to-point RapidIO network interconnection among all FPGA control chips and being responsible for transmitting data packets sent by the FPGA control chips to a target FPGA control chip.

5. The RapidIO-based multi-network isolation gatekeeper switching unit of claim 4, wherein two groups of GTXs are connected between the FPGA control chip and the RapidIO switching chip.

6. The RapidIO-based multi-network isolation gatekeeper switching unit according to claim 5, wherein two sets of data interaction architectures are configured in the FPGA control chip, and each set of data interaction architecture comprises a RapidIO IP core, a data sending module, a data receiving module, a maintenance module, a sending end FIFO module and a receiving end FIFO module.

7. The RapidIO-based multi-network isolation gatekeeper switching unit of claim 6, wherein the transmitting end FIFO module of each group of data interaction architecture is used to buffer half of the data read from the dual port RAM chip.

8. The RapidIO-based multi-network isolation gatekeeper switching unit as claimed in claim 7, wherein the function of the data sending module is to generate and send RapidIO request transaction, and when data is transmitted, the sending module sends data to the switch, and sends device ID and destination ID to the switch.

9. The RapidIO-based multi-network isolation gatekeeper switching unit of claim 8, wherein the data receiving module is responsible for receiving data, separating a packet header and carried data, distinguishing whether the received transaction is a stream write transaction, and preparing to write data into the FIFO module.

10. The RapidIO-based multi-network isolation gatekeeper switching unit of claim 9, wherein the receiving end FIFO module is used to align the timing of two paths of data for facilitating subsequent merging.

Images