CN211207318U

CN211207318U - Network security isolation device

Info

Publication number: CN211207318U
Application number: CN201921676502.0U
Authority: CN
Inventors: 叶飞; 许林; 郑波; 黄波; 李超然; 梁玉涛; 杜振业; 王庆年; 付建强; 淳增辉; 徐鹏飞; 范颖; 陈昊; 汤灵; 邓松; 郭浩; 张昕; 周愚; 黄灿
Original assignee: 722th Research Institute of CSIC
Current assignee: 722th Research Institute of CSIC
Priority date: 2019-10-09
Filing date: 2019-10-09
Publication date: 2020-08-07
Anticipated expiration: 2029-10-09

Abstract

The utility model discloses a network security isolation equipment belongs to network security technical field. The COM-Express interface circuit board comprises a first network interface circuit board, a second network interface circuit board, a first mainboard, a second mainboard, a first COM-Express module, a second COM-Express module, a transmitting circuit board and a receiving circuit board; the first mainboard and the second mainboard are provided with a COM-Express slot and at least two PCIe slots which are connected; the COM-Express connectors on the first COM-Express module and the second COM-Express module are sequentially inserted into COM-Express slots on the first mainboard and the second mainboard; PCIe gold fingers on the first network interface circuit board and the transmitting circuit board, PCIe gold fingers on the second network interface circuit board and the receiving circuit board are sequentially inserted into PCIe slots on the first mainboard and the second mainboard. The utility model discloses can reduce the work load of upgrading.

Description

Network security isolation device

Technical Field

The utility model relates to a network security technical field, in particular to network security isolation equipment.

Background

The network security isolation means that the bottom layer protocols of the two networks are completely terminated, information exchange is only carried out on an application layer, measures such as application layer data restoration, filtering scanning, virus checking and killing, access control and the like are assisted, and the behaviors of the two isolated networks are guaranteed not to be influenced mutually, so that the high security of the isolated protection network is guaranteed. Therefore, the network security isolation technology is a high-strength network isolation technology, i.e., a strong logic isolation technology, and is the network security technology with the highest protection level on the premise of ensuring real-time information exchange.

The existing network security isolation device comprises a host, an isolation card connected with an internal network and an isolation card connected with an external network, wherein each isolation card comprises a network interface connector and a network card chip. The host is provided with a network security protection and application agent system which is respectively connected with the network card chips in the two isolation cards and used for realizing the termination of a TCP/IP (Transmission control Protocol/Internet Protocol, Chinese: Transmission control Protocol/Internet Protocol) Protocol and the data encapsulation of a private Protocol; the network card chip is connected with a network interface connector in the same isolation card and is used for unidirectionally sending private protocol data to the isolation card at the opposite end through an Ethernet protocol; the network port connectors of the two isolation cards are in one-way connection and are used for realizing data ferry between the two hosts.

Network security isolation techniques have evolved to the fifth generation of secure channel isolation. The safety channel isolation realizes the isolation and data exchange of the internal and external networks through safety mechanisms such as special communication hardware and a proprietary safety protocol. The method not only solves the problems of the prior isolation technology, effectively isolates the internal and external networks, but also efficiently realizes the safe exchange of the data of the internal and external networks, transparently supports various network applications, and becomes the development direction of the current isolation technology.

In the process of implementing the present invention, the inventor finds that the prior art has at least the following problems:

when the network security protection system in the host needs to be updated, the CPU in the host may be changed accordingly. Because the interface types of different CPUs are different, the isolation card connected with the host computer also needs to be replaced correspondingly, the whole network security isolation equipment basically needs to be developed again, the workload is large, the development time is long, the upgrading progress of the network security isolation equipment is seriously influenced, the network security isolation equipment cannot be upgraded in time, and the potential safety hazard of the network is caused.

SUMMERY OF THE UTILITY MODEL

In order to solve the problem of the prior art, the embodiment of the utility model provides a network security isolation equipment is provided, the work load that can effectively reduce network security isolation equipment upgrading shortens network security isolation equipment's development cycle, ensures network security. The technical scheme is as follows:

the embodiment of the utility model provides a network security isolation equipment, network security isolation equipment includes first network interface circuit board, second network interface circuit board, first mainboard, second mainboard, first COM-Express module, second COM-Express module, transmission circuit board and receiving circuit board;

the first mainboard and the second mainboard are respectively provided with a COM-Express slot and at least two PCIe slots, and the at least two PCIe slots are respectively connected with the COM-Express slot;

the first COM-Express module and the second COM-Express module respectively comprise a CPU circuit provided with a security protocol and a COM-Express connector defined with various standard interfaces, and the COM-Express connector is connected with the CPU circuit; the COM-Express connector on the first COM-Express module is inserted into the COM-Express slot on the first mainboard, and the COM-Express connector on the second COM-Express module is inserted into the COM-Express slot on the second mainboard;

PCIe gold fingers are arranged on the first network interface circuit board, the second network interface circuit board, the transmitting circuit board and the receiving circuit board respectively; the PCIe gold fingers on the first network interface circuit board and the PCIe gold fingers on the transmitting circuit board are respectively inserted into different PCIe slots on the first mainboard, and the PCIe gold fingers on the second network interface circuit board and the PCIe gold fingers on the receiving circuit board are respectively inserted into different PCIe slots on the second mainboard.

Optionally, the plurality of standard interfaces include a plurality of power interfaces, ethernet interfaces, PCIe interfaces, SATA interfaces, SPI interfaces, USB interfaces, I2C bus interfaces, GPIO interfaces, VGA interfaces, L VDS interfaces, DVI/HDMI interfaces, DDI interfaces, L PC interfaces, and SMBus interfaces.

Further, the first COM-Express module and the second COM-Express module further include an interface translator connected in series between the COM-Express connector and the CPU circuit.

Optionally, the first network interface circuit board and the second network interface circuit board are network cards.

Further, the transmitting circuit board comprises a first PCIe interface circuit, a data coding circuit and a light emitting circuit which are connected in sequence, the receiving circuit board comprises a second PCIe interface circuit, a data decoding circuit and a light receiving circuit which are connected in sequence, and the light receiving circuit and the light emitting circuit are arranged oppositely.

The utility model relates to a possible implementation, data coding circuit be with the same network card of first network interface circuit board, data decoding circuit be with the same network card of second network interface circuit board.

In another possible implementation of the present invention, the data encoding circuit and the data decoding circuit are FPGA chips, and the FPGA chips include non-routing communication circuits.

Optionally, the FPGA chip further includes a security algorithm circuit, and the security algorithm circuit includes one or more of an encryption circuit, a filtering circuit, and a verification circuit.

In one possible implementation of the present invention, the light emitting circuit and the light receiving circuit are optical modules of simplex transmission.

In another possible implementation manner of the present invention, the optical transmitter is an optical transmitter, and the optical receiver is an optical receiver.

The embodiment of the utility model provides a beneficial effect that technical scheme brought is:

the CPU circuit installed with the security protocol is realized in the COM-Express module, and the unified COM-Express connector and the compatible interface definition are configured, so that the CPU circuits of various types can be inserted into COM-Express slots on the mainboard, and PCIe gold fingers are arranged on the network interface circuit board, the transmitting circuit board and the receiving circuit board and can be inserted into PCIe slots on the mainboard to be connected with the CPU circuit. That is to say, no matter how the CPU circuit changes, only the COM-Express module is designed according to the change of the CPU circuit, and the unified COM-Express connector and the compatible interface definition are provided, so that the network interface circuit board, the transmitting circuit board, and the receiving circuit board can be connected through the motherboard without developing the whole network security isolation device, thereby greatly reducing the workload of upgrading the network security isolation device, shortening the development cycle of the network security isolation device, and ensuring the network security to the maximum extent.

Drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings needed to be used in the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present invention, and it is obvious for those skilled in the art to obtain other drawings without creative efforts.

Fig. 1 is a schematic structural diagram of a network security isolation device according to an embodiment of the present invention.

Detailed Description

In order to make the objects, technical solutions and advantages of the present invention clearer, embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

The embodiment of the utility model provides a network security isolation equipment. Fig. 1 is a schematic structural diagram of a network security isolation device provided by an embodiment of the present invention. Referring to fig. 1, the network security isolation device includes a first network interface circuit board 11, a second network interface circuit board 21, a first motherboard 12, a second motherboard 22, a first COM-on-Module-Express (english: Computer-on-Module-Express, chinese: fast modular Computer) 13, a second COM-Express Module 23, a transmitting circuit board 14, and a receiving circuit board 24.

In this embodiment, the first motherboard 12 and the second motherboard 22 are respectively provided with a COM-Express slot 31 and at least two PCIe (peripheral component interconnect Express) slots 32, and the at least two PCIe slots 32 are respectively connected to the COM-Express slot 31.

The first COM-Express module 13 and the second COM-Express module 23 each include a CPU (central processing unit, chinese) circuit 41 mounted with a security protocol and a COM-Express connector 42 defining a plurality of standard interfaces, and the COM-Express connector 42 is connected to the CPU circuit 41. The COM-Express connector 42 on the first COM-Express module 13 plugs into the COM-Express slot 31 on the first motherboard 12, and the COM-Express connector 42 on the second COM-Express module 23 plugs into the COM-Express slot 31 on the second motherboard 22.

The first network interface circuit board 11, the second network interface circuit board 21, the transmitting circuit board 14 and the receiving circuit board 24 are respectively provided with PCIe gold fingers 50. The PCIe gold finger 50 on the first network interface circuit board 11 and the PCIe gold finger 50 on the transmitting circuit board 14 are respectively inserted into different PCIe slots 32 on the first motherboard 12, and the PCIe gold finger 50 on the second network interface circuit board 21 and the PCIe gold finger 50 on the receiving circuit board 24 are respectively inserted into different PCIe slots 32 on the second motherboard 22.

The embodiment of the utility model provides a CPU circuit through installing safe agreement realizes in COM-Express module to dispose unified COM-Express connector and compatible interface definition, make the CPU circuit of various models all can insert in the COM-Express slot on the mainboard, all be equipped with the PCIe golden finger on network interface circuit board, transmitting circuit board and the receiving circuit board simultaneously, can insert in the PCIe slot on the mainboard with CPU circuit connection. That is to say, no matter how the CPU circuit changes, only the COM-Express module is designed according to the change of the CPU circuit, and the unified COM-Express connector and the compatible interface definition are provided, so that the network interface circuit board, the transmitting circuit board, and the receiving circuit board can be connected through the motherboard without developing the whole network security isolation device, thereby greatly reducing the workload of upgrading the network security isolation device, shortening the development cycle of the network security isolation device, and ensuring the network security to the maximum extent.

And the processor circuit board, the network interface circuit board, the transmitting circuit board and the receiving circuit board are all inserted into the slots on the mainboard, so that the mutual detachment is convenient, individual parts are easy to replace when having problems, the maintenance is simple, the consumed time is short, and the influence on the network safety can be avoided as far as possible.

Alternatively, the COM-Express slot 31 and the PCIe slot 32 may be provided with a clip to fix the COM-Express module and the circuit board.

In addition, a safety protocol is installed on the CPU computer, and a safety function is realized inside the network safety isolation device, so that the safety is high.

In practical application, the COM-Express Module is compatible with the pci (english: peripheral component interconnect Industrial Computer Manufacturers Group, chinese: peripheral component interconnect standards) COM Express Base Specification (chinese: Module Base Specification), supports multiple pin types such as type 2, type6, and type10, supports CPUs of different models and different operation capabilities such as x86, schenwei, loongson, and feiteng, can meet the model requirements of different CPU platforms, and is beneficial to the maintenance of network security isolation devices.

Alternatively, the multiple standard interfaces may include a power Interface, an Ethernet Interface, a PCIe Interface, a SATA (Serial Advanced Technology Attachment, Chinese) Interface, a SPI (Serial Peripheral Interface, Chinese), a USB (Universal Serial Bus) Interface, a I2C (Inter-Integrated Circuit, Chinese) Interface, a GPIO (General-Purpose Input/Output, Chinese) Interface, a VGA (Video Graphics Array, Chinese) Interface, a VDS (Chinese Video Graphics Array), a L VDS (L-Video Differential Signaling, Chinese-low Voltage Signaling) Interface, a DVI/Video Display (DVI/Video Display Interface, a DVI Interface, a Digital Video Interface (DDP) Interface, a Digital Video Interface (DDP Interface, a Digital Video Interface (DDP Interface, a Digital Video Display Interface, a Digital Video Interface, a Display Interface, a Digital Video Interface, a.

The standard interfaces defined by the COM-Express connector are rich in types, and the function of the network security isolation device can be conveniently realized.

Further, as shown in FIG. 1, the first COM-Express module 12 and the second COM-Express module 23 may further include an interface translator 43, the interface translator 43 being connected in series between the COM-Express connector 42 and the CPU circuit 41.

By adding the interface converter, the interface in the CPU circuit 41 can be converted into the interface which is not provided by the CPU circuit 41 and is defined by the COM-Express connector, so that the interface type defined by the COM-Express connector is increased, and the functional requirement of the network security isolation device is met.

Optionally, the first motherboard 12 and the second motherboard 22 may further be provided with an interface converter and other interface slots, such as a network port slot and a USB slot, where the interface converter is connected in series between the other interface slots and the COM-Express slot or the PCIe slot to expand interfaces supported by the motherboards, which is beneficial to implementing functions of the network security isolation device.

Alternatively, the first network interface circuit board 11 and the second network interface circuit board 21 may be network cards.

The method is realized by directly adopting finished products, is simple and convenient, can reduce the workload of the development of the network security isolation equipment, shortens the development time and is beneficial to ensuring the network security.

Illustratively, the Network Card may be one of NMC (English: Network Mezzanine Card, Chinese: Mezzanine Card), AMC (English: Advanced Mezzanine Card, Chinese: Advanced Mezzanine Card), XMC (Switchedmezzanine Card, Chinese: interchange Mezzanine Card), and OCP (Open computer Project, Chinese: Open computing Project) NIC (English: Network interface controller, Chinese: Network interface controller), OCP Mezzanine cards.

The NMC usually adopts a standard PCIe gold finger, and the specific size specifications produced by different enterprises are slightly different, and generally is a network card module customized by manufacturers for devices such as a firewall and a router. AMC is a module defined in ATCA (Advanced telecom computing Architecture, Chinese) standard, and is compatible with standards AMC.0R1.0, AMC.0R2.0, AMC.1R2.0 and IPMIv 1.5. XMC is an open high-speed interconnect standard based on PMC (PCI mezzanine card, Chinese: PCI mezzanine card), and the size of XMC module is defined by IEEE (Institute of Electrical and Electronics Engineers, Chinese: Institute of Electrical and Electronics Engineers) 1386, which refers to VITA 42.0 standard. OCP is an open source hardware project established in 2011 by Facebook, usa.

Further, as shown in fig. 1, the transmitting circuit board 14 may include a first PCIe interface circuit 141, a data encoding circuit 142, and a light emitting circuit 143 connected in this order, and the receiving circuit board 24 may include a second PCIe interface circuit 241, a data decoding circuit 242, and a light receiving circuit 243 connected in this order, the light receiving circuit 243 being disposed opposite to the light emitting circuit 143.

Data transmission is realized through light, the effect of network isolation is good, and the technical requirement of fifth-generation safety channel isolation is met.

In practical applications, the communication between the optical transmitter 143 and the optical receiver 243 may be based on one of the non-routing communication protocols, such as Aurora simplex protocol, ethernet protocol, USB protocol, etc.

In an implementation manner of this embodiment, the data encoding circuit 142 may be a network card same as the first network interface circuit board 11, and the data decoding circuit 242 may be a network card same as the second network interface circuit board 21.

Accordingly, communication between the data encoding circuit 142 and the data decoding circuit 242 is based on the non-routed ethernet protocol and simplex transmission.

In another implementation manner of this embodiment, the data encoding circuit 142 and the data decoding circuit 242 may be FPGA (Field-Programmable Gate Array) chips, and the FPGA chips include the non-routing communication circuit.

The two implementation modes are realized by adopting finished products, are simple and convenient, can reduce the workload of network security isolation equipment development, shorten the development time and are beneficial to ensuring the network security.

In practical applications, the data encoding circuit 142 and the data decoding circuit 242 may be based on the same non-routing communication protocol and simplex transmission. Further, the data encoding circuit 142 and the data decoding circuit 242 may be implemented by using the same communication chip, and an encoding chip and a decoding chip used in cooperation.

Optionally, the FPGA chip may further include a security algorithm circuit, and the security algorithm circuit includes one or more of an encryption circuit, a filtering circuit, and a verification circuit.

When the data encoding circuit 142 and the data decoding circuit 242 are implemented by using FPGA chips, hardware circuits inside the FPGA chips can be changed to implement a security algorithm, so that functions of network security isolation equipment are enhanced, and network security is guaranteed.

In one implementation of the present embodiment, the light emitting circuit 143 and the light receiving circuit 243 may be optical modules for simplex transmission.

In another implementation of this embodiment, the optical transmitting circuit 143 may be an optical transmitter, and the optical receiving circuit 243 may be an optical receiver.

The working process of the network security isolation device provided by the embodiment of the present invention is briefly described below with reference to fig. 1.

The first network interface circuit board 11 receives data in the first network, and the data sequentially passes through the PCIe gold finger 50 on the first network interface circuit board 11, the PCIe slot 32 on the first motherboard 12, the COM-Express slot 31 on the first motherboard 12, and the COM-Express connector 42 in the first COM-Express module 13 to reach the CPU circuit 41 in the COM-Express module 13. The CPU circuit 41 performs security processing (including security policy examination, protocol feature examination, virus feature examination, log recording, etc.) on the data, and then sequentially passes through the COM-Express connector 42 in the COM-Express module 13, the COM-Express slot 31 on the first motherboard 12, the PCIe slot 32 on the first motherboard 12, and the PCIe gold finger 50 on the transmitting circuit board 14 to reach the transmitting circuit board 14. The transmitting circuit board 14 transmits the data to the receiving circuit board 24. The receiving circuit board 24 receives the data, and the data sequentially passes through the PCIe gold finger 50 on the receiving circuit board 24, the PCIe slot 32 on the second motherboard 22, the COM-Express slot 31 on the second motherboard 22, and the COM-Express connector 42 in the second COM-Express module 23, and reaches the CPU circuit 41 in the second COM-Express module 23. The CPU circuit 41 performs secure processing on the data, and then sequentially passes through the COM-Express connector 42 in the second COM-Express module 23, the COM-Express slot 31 on the second motherboard 22, the PCIe slot 32 on the second motherboard 22, and the PCIe gold finger 50 on the second network interface circuit board 21 to reach the second network interface circuit board 21. The second network interface circuit board 21 transmits data into the second network.

The first network and the second network are two networks isolated from each other. For example, the first network is an external network and the second network is an internal network.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the present invention, and any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention should be included within the protection scope of the present invention.

Claims

1. A network security isolation device, characterized in that it comprises a first network interface circuit board (11), a second network interface circuit board (21), a first motherboard (12), a second motherboard (22), a first COM-Express module (13), a second COM-Express module (23), a transmit circuit board (14) and a receive circuit board (24);

the first mainboard (12) and the second mainboard (22) are respectively provided with a COM-Express slot (31) and at least two PCIe slots (32), and the at least two PCIe slots (32) are respectively connected with the COM-Express slot (31);

the first COM-Express module (13) and the second COM-Express module (23) both comprise a CPU circuit (41) mounted with a security protocol and a COM-Express connector (42) defined with a plurality of standard interfaces, and the COM-Express connector (42) is connected with the CPU circuit (41); the COM-Express connector (42) on the first COM-Express module (13) is plugged into a COM-Express slot (31) on the first motherboard (12), and the COM-Express connector (42) on the second COM-Express module (23) is plugged into a COM-Express slot (31) on the second motherboard (22);

PCIe gold fingers (50) are respectively arranged on the first network interface circuit board (11), the second network interface circuit board (21), the transmitting circuit board (14) and the receiving circuit board (24); PCIe gold finger (50) on the first network interface circuit board (11) and PCIe gold finger (50) on the transmitting circuit board (14) are respectively inserted into different PCIe slots (32) on the first mainboard (12), and PCIe gold finger (50) on the second network interface circuit board (21) and PCIe gold finger (50) on the receiving circuit board (24) are respectively inserted into different PCIe slots (32) on the second mainboard (22).

2. The network security isolation device of claim 1, wherein the plurality of standard interfaces comprise a plurality of power interfaces, ethernet interfaces, PCIe interfaces, SATA interfaces, SPI interfaces, USB interfaces, I2C bus interfaces, GPIO interfaces, VGA interfaces, L VDS interfaces, DVI/HDMI interfaces, DDI interfaces, L PC interfaces, SMBus interfaces.

3. The network security isolation device of claim 2, wherein the first COM-Express module (13) and the second COM-Express module (23) further comprise an interface translator (43), the interface translator (43) being connected in series between the COM-Express connector (42) and the CPU circuit (41).

4. The network security isolation device according to any one of claims 1 to 3, wherein the first network interface circuit board (11) and the second network interface circuit board (21) are network cards.

5. The network security isolation device of claim 4, wherein the transmitting circuit board (14) comprises a first PCIe interface circuit (141), a data encoding circuit (142) and an optical transmitting circuit (143) which are connected in sequence, the receiving circuit board (24) comprises a second PCIe interface circuit (241), a data decoding circuit (242) and an optical receiving circuit (243) which are connected in sequence, and the optical receiving circuit (243) is arranged opposite to the optical transmitting circuit (143).

6. The network security isolation device of claim 5, wherein the data encoding circuit (142) is the same network card as the first network interface circuit board (11), and the data decoding circuit (242) is the same network card as the second network interface circuit board (21).

7. The network security isolation device of claim 5 wherein the data encoding circuit (142) and the data decoding circuit (242) are FPGA chips that include non-routing communication circuitry.

8. The network security isolation device of claim 7, wherein the FPGA chip further comprises a security algorithm circuit comprising one or more of an encryption circuit, a filtering circuit, and a verification circuit.

9. The network security isolation device of claim 5, wherein the optical transmitter circuit (143) and the optical receiver circuit (243) are simplex transmission optical modules.

10. The network security isolation device of claim 5, wherein the optical transmitting circuit (143) is an optical transmitter and the optical receiving circuit (243) is an optical receiver.