CN217428138U - Firewall device - Google Patents

Abstract

The utility model discloses a prevent hot wall equipment. Wherein, this firewall equipment includes: a main board; the processor is arranged on the mainboard and used for receiving the network data and filtering abnormal information in the network data; the first chip is arranged on the mainboard and connected with the processor through a first serial bus, wherein a plurality of first-type network ports are arranged on the first chip, and the first-type network ports are network ports for receiving optical signals; and the second chip is arranged on the mainboard and connected with the processor through a serial computer expansion bus, wherein a plurality of connection ports for connecting network adapters are arranged on the second chip, each network adapter is provided with a second type network port, and the second type network ports are network ports for receiving electric signals. The utility model provides a current prevent that hot wall equipment leads to preventing the technical problem that the applied scene of hot wall equipment is limited because the net gape resource of treater is few.

Description

Firewall device

Technical Field

The utility model relates to a network security field particularly, relates to a prevent hot wall equipment.

Background

With the integration and deepening of the industrial control system and the information network, the mode of attacking the industrial control network is more complicated and changeable, and the industrial control system faces unprecedented security threats. In an industrial control system, firewall equipment is indispensable for maintaining network security. Firewall devices are typically deployed intermediate the internal industrial network and the external internet to protect computers, applications, and other resources in the internal industrial network from external attacks. In other words, the firewall device can be regarded as a security policy checkpoint, all incoming and outgoing network data must pass through the firewall device, and after the firewall device identifies suspicious information in the network data, the suspicious information can be filtered.

However, in the conventional firewall device, the number of network ports of the processor mounted on the firewall device is small, so that the firewall device cannot be connected with a larger number of network devices at the same time.

In view of the above problems, no effective solution has been proposed.

SUMMERY OF THE UTILITY MODEL

The embodiment of the utility model provides a prevent hot wall equipment to at least, solve current prevent hot wall equipment because the net gape resource of treater is few, lead to preventing the technical problem that the applied scene of hot wall equipment is limited.

According to the utility model discloses an aspect of the embodiment provides a prevent hot wall equipment, include: a main board; the processor is arranged on the mainboard and used for receiving the network data and filtering abnormal information in the network data; the first chip is arranged on the mainboard and connected with the processor through a first serial bus, wherein a plurality of first-type network ports are arranged on the first chip, and the first-type network ports are network ports for receiving optical signals; and the second chip is arranged on the mainboard and connected with the processor through a serial computer expansion bus, wherein a plurality of connection ports for connecting network adapters are arranged on the second chip, each network adapter is provided with a second type network port, and the second type network ports are network ports for receiving electric signals.

Optionally, the firewall device further includes: and the plurality of third chips are arranged on the mainboard and connected with the processor, wherein each third chip is provided with a second type network port.

Optionally, the processor includes: the first port is connected with the first chip through a first serial bus, wherein the communication protocol of the first port corresponds to the communication protocol of the first serial bus; the second port is connected with at least two third chips through a parallel bus, wherein the communication protocol of the second port corresponds to the communication protocol of the parallel bus; the third port is connected with a third chip through a second serial bus, wherein the communication protocol of the third port corresponds to that of the second serial bus, the second serial bus is a one-way transmission serial bus, and the first serial bus is a four-way transmission serial bus; and the fourth port is connected with the second chip through the serial computer expansion bus, wherein the communication protocol of the fourth port corresponds to the communication protocol of the serial computer expansion bus.

Optionally, the firewall device further includes: and the timer is arranged on the mainboard, is connected with the processor and is used for configuring the time information of the processor.

Optionally, the firewall device further includes: and the clock buffer is arranged on the second chip and used for carrying out time synchronization on the second chip.

Optionally, the firewall device further includes: and the reset button is arranged on the mainboard and used for resetting the first chip, the second chip and the plurality of third chips.

Optionally, the firewall device further includes: and the extension slot is arranged on the mainboard, and is used for connecting a plurality of firewall equipment in parallel.

Optionally, the firewall device further includes: and the storage device is connected with the processor and is used for storing the processing information generated after the processor processes the network data.

Optionally, the firewall device further includes: and the universal serial interfaces are arranged on the processor, are connected with the external input equipment through a universal serial bus, and are used for receiving input information sent by the external input equipment.

Optionally, the firewall device further includes: and the indicator light is connected with the processor and used for generating different light information according to the state information of the processor.

In the application, the first chip and the second chip are connected with the processor respectively, the processor is arranged on the mainboard and used for receiving network data and filtering abnormal information in the network data, and meanwhile, the first chip is connected with the processor through the first serial bus, and the second chip is connected with the processor through the serial computer expansion bus. The first chip is provided with a plurality of first-type network ports, and the first-type network ports are network ports for receiving optical signals; the second chip is provided with a plurality of connection ports for connecting network adapters, each network adapter is provided with a second type network port, and the second type network ports are network ports for receiving electric signals.

As can be seen from the above, the firewall device in the present application includes the first chip and the second chip, and the first chip is provided with a plurality of first-type ports for receiving optical signals, so that the firewall device in the present application achieves an effect of extending more first-type ports for the processor by connecting the processor with the first chip. Meanwhile, the second chip is provided with a connection port for connecting the network adapters, and each network adapter is provided with a second type network port for receiving electric signals, so that the firewall in the application also achieves the effect of expanding more second type network ports for the processor.

Therefore, compared with the existing firewall equipment, the firewall equipment provided by the application achieves the purpose of providing more network ports in quantity and types for the processor, and achieves the effect of connecting more network equipment based on one firewall equipment, so that the problem that the application scene of the firewall equipment is limited due to the fact that the network port resources of the processor are few in the existing firewall equipment is solved.

Drawings

The accompanying drawings, which are included to provide a further understanding of the invention and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the invention and together with the description serve to explain the invention without undue limitation to the invention. In the drawings:

fig. 1 is a block diagram of an alternative firewall device in accordance with an embodiment of the invention;

fig. 2 is a partial block diagram of a firewall device according to an embodiment of the invention;

fig. 3 is a schematic diagram of a firewall device according to an embodiment of the invention;

fig. 4 is a partial block diagram of a firewall device according to an embodiment of the present invention.

100-a main board; 200-a processor; 300-a first chip; 400-a second chip; 500-a network adapter; 600-a third chip; 700-expansion slot; 800-a storage device; 900-indicator light;

210 — a first port; 220-a second port; 230-a third port; 240-fourth port; 250-universal serial interface; 211-a first serial bus; 221-parallel bus; 231-a second serial bus; 241-serial computer expansion bus; 310-a first type of portal; 410-a connection port; 510-a second type of portal; 520-a transformer;

1001-timer; 1002-serial peripheral interface pin header; 1003-random access memory; 1004-embedded memory; 1005-a first flash memory; 1006-a second flash memory; 1007-external input device.

Detailed Description

In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments in the present invention, all other embodiments obtained by a person skilled in the art without creative efforts shall belong to the protection scope of the present invention.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

Example 1

According to the embodiment of the utility model provides an embodiment of preventing hot wall equipment is provided, fig. 1 is according to the utility model discloses an optional structure chart of preventing hot wall equipment of embodiment, as shown in fig. 1, prevent hot wall equipment in this application includes: a main board 100; the processor 200 is arranged on the main board 100 and is used for receiving the network data and filtering abnormal information in the network data; a first chip 300, disposed on the motherboard 100, and connected to the processor 200 through a first serial bus 211, where a plurality of first type ports 310 are disposed on the first chip 300, and the first type ports 310 are ports for receiving optical signals; and a second chip 400 disposed on the motherboard 100 and connected to the processor 200 through a serial computer expansion bus 241, wherein the second chip 400 is provided with a plurality of connection ports 410 for connecting to the network adapters 500, each network adapter 500 is provided with a second-type network port 510, and the second-type network port 510 is a network port for receiving electrical signals.

The processor can adopt an LS1046A quad-core processor, the main frequency of the processor 200 can reach 108GHz at most, and an ARMCortex-A72 architecture is used. The first chip 300 may be a YT8614 chip, wherein the YT8614 chip is an ethernet PHY chip supporting a QSGMII interface, four 10/100/1000UTP electrical ports, and four SGMII/Fiber ports. The YT8614 chip supports 6 operating modes, which can be configured by the POS to correspond to the modes. Different operating modes invoke different modules within. The application chooses to configure the YT8614 CHIP in QSGMII x1+ FIBER x4 MODE, and selects the CHIP _ MODE [ 2: 0] is configured to 011. The second chip 400 may be an ASM1184 chip, the first serial bus 211 may be a QSGMII bus, the first type of port 310 may be an optical port as understood by those skilled in the art, the serial computer expansion bus 241 may be a PCIE (peripheral component interconnect express), the network adapter 500 may be an I211 network adapter, and the second type of port 510 may be an electrical port as understood by those skilled in the art.

Specifically, the LS1046A quad-core processor is connected with the YT8614 chip through the QSGMII bus, and the LS1046A quad-core processor is connected with the ASM1184 chip through the PCIE bus. On this basis, because YT8614 is provided with 4 optical ports on the chip itself, through connecting YT8614 chip, this application has actually expanded 4 optical ports for LS1046A quad-core processor. In addition, although the ASM1184 chip itself is not provided with a network port, 4 connection ports 410 for connecting the I211 network adapters are provided on the ASM1184 chip, so that the ASM1184 chip can be connected with 4I 211 network adapters, and meanwhile, each I211 network adapter is provided with one electrical port, so that by connecting the ASM1184 chip, the application expands 4 electrical ports for the LS1046A quad-core processor.

As can be seen from the above, since the firewall device in the present application includes the first chip 300 and the second chip 400, and the first chip 300 is provided with a plurality of first type ports 310 for receiving optical signals, the firewall device in the present application achieves an effect of expanding more first type ports 310 for the processor 200 by connecting the processor 200 to the first chip 300. Meanwhile, since the second chip 400 is provided with the connection port 410 for connecting the network adapters 500 and each network adapter 500 is provided with the second-type network port 510 for receiving an electrical signal, the firewall in the present application also achieves the effect of extending more second-type network ports 510 for the processor 200.

Therefore, compared with the existing firewall equipment, the firewall equipment provided by the application achieves the purpose of providing more network ports in quantity and types for the processor 200, and achieves the effect of connecting more network equipment based on one firewall equipment, so that the problem that the application scene of the firewall equipment is limited due to the fact that the network port resources of the processor 200 are few in the existing firewall equipment is solved.

In an alternative embodiment, fig. 2 shows a partial block diagram of a firewall device according to an embodiment of the invention. As shown in fig. 2, the processor 200 is connected to a first chip 300, and four first type ports 310 are disposed on the first chip 300. In other words, four optical ports may be extended for the processor 200 through the first chip 300.

In an optional embodiment, the firewall device in the present application further includes: and a plurality of third chips 600 disposed on the motherboard 100 and connected to the processor 200, wherein each third chip 600 has a second-type network port 510 disposed thereon.

Alternatively, the third chip 600 may be an RTL8211FS chip. Specifically, the RTL8211FS itself is also provided with a mesh, but unlike 4 optical ports per YT8614 chip, each RTL8211FS chip is provided with an electrical port.

It should be noted that the firewall device in the present application also achieves the purpose of extending more electrical ports for the processor 200 through the third chip 600, so as to solve the problem that the application scenario of the firewall device is limited due to less network port resources of the processor 200 in the existing firewall device.

In an alternative embodiment, fig. 3 shows a schematic diagram of a firewall device according to an embodiment of the invention. As shown in fig. 3, the processor 200 in the present application includes: a first port 210 connected to the first chip 300 through a first serial bus 211, wherein a communication protocol of the first port 210 corresponds to a communication protocol of the first serial bus 211; a second port 220 connected to at least two third chips 600 through a parallel bus 221, wherein a communication protocol of the second port 220 corresponds to a communication protocol of the parallel bus 221; a third port 230 connected to a third chip 600 through a second serial bus 231, wherein the communication protocol of the third port 230 corresponds to the communication protocol of the second serial bus 231, the second serial bus 231 is a single-channel transmission serial bus, and the first serial bus 211 is a four-channel transmission serial bus; and a fourth port 240 connected to the second chip 400 through a serial computer expansion bus 241, wherein a communication protocol of the fourth port 240 corresponds to a communication protocol of the serial computer expansion bus 241.

The parallel bus 221 is an rgmii (reduced gigabit media independent interface) bus, the second serial bus 231 is an SGMII (serial bus), and compared with a QSGMII (q serial bus), the SGMII bus is a one-way transmission bus and the QSGMII bus is a four-way transmission bus.

Optionally, an 8-lane SerDes module resource is provided in the LS1046A quad-core processor, wherein the SerDes module controller may configure different modes for a plurality of ports of the LS1046A quad-core processor by configuring the value of the register. Specifically, in order to reasonably utilize the SerDes module resources of the LS1046A quad-core processor to expand more network ports, the SerDes1 module controller configures 3040 the value of the corresponding register, and on this basis, the first port 210, the second port 220, and the third port 230 on the LS1046A quad-core processor are set in QSGMII mode, RGMII mode, and SGMII mode, respectively. In addition, the value of the corresponding register is set to 5559 by the SerDes2 module controller, and the fourth port 240 is set to PCIE mode. By setting the corresponding mode for each port, the communication protocol of the port can be ensured to correspond to the communication protocol of the bus to which the port needs to be connected. For example, since the first port 210 is set to QSGMII mode, the first port 210 may be connected to a QSGMII bus and implement communication, it should be noted that the first port 210 configured to QSGMII mode may combine 4 SGMII interfaces with a rate of 1.25Gbps into a differential signal with a rate of 5Gbps, and the first port 210 reduces the number of pins connected to the MAC interface, thereby reducing the overall power consumption. Because of the fast operating speed, each signal pair can be implemented as a differential pair, thereby optimizing signal integrity while minimizing system noise. In addition, since the second port 220 is set to the RGMII mode, the second port 220 can be connected to and communicate with the RGMII bus. This is also true for the third port 230 and the fourth port 240, which will not be described herein.

In an alternative embodiment, as shown in fig. 3, a third chip 600 may extend out of a second type portal 510, a first chip 300 may extend out of 4 first type portals 310, a second chip 400 may be connected to 4 network adapters 500, each network adapter 500 may extend out of a second type portal 510. It can be seen that the firewall device in the present application extends at least 7 electrical ports and 4 optical ports for the processor 200.

In an alternative embodiment, as shown in fig. 3, an expansion slot 700 is further provided on the motherboard 100 in the present application, where the expansion slot 700 is used to connect multiple firewall devices in parallel, and the expansion slot 700 is connected to the processor 200 through a PCIE bus. In addition, the firewall device in this application further includes a storage device 800, where the storage device 800 is connected to the processor 200 through an SATA (serial advanced technology attachment) bus, and is configured to store processing information generated after the processor 200 processes network data. Also provided on the processor 200 are a plurality of universal serial interfaces 250, such as USB interfaces. These universal serial interfaces 250 are connected to the external input device 1007 through a universal serial bus, and are used to receive input information transmitted from the external input device 1007. The external input device 1007 may be a mouse, a keyboard, or the like. The firewall device further comprises an indicator lamp 900 connected to the processor 200 for generating different light information according to the status information of the processor 200. For example, the indicator lamp 900 is connected to an I/O (input/output) port of the processor 200 through a GPIO (general-purpose input/output) line, and if the processor 200 is in a normal state, the color of the indicator lamp 900 is green, and if the processor 200 is in an abnormal state, the color of the indicator lamp 900 is red.

Optionally, as shown in fig. 3, an I2C (inter-integrated circuit) port is disposed on the processor 200, wherein the I2C port is connected to a timer 1001, the timer 1001 is used for configuring time information of the processor 200, and in practical applications, the timer 1001 may be a TEMP RTC.

In addition, as shown in fig. 3, the processor 200 is further provided with an SPI (serial peripheral interface) port, a DDR (double data rate synchronous dynamic random access memory) port, an SDHC (secure digital high capacity memory card) port, an IFC (index foundation classes, an open source data exchange interface) port, and a QSPI (Q serial peripheral interface, four-way transmission serial peripheral interface) port. The SPI port is connected with a serial peripheral interface pin 1002, the DDR port is connected with a random access memory 1003, the SDHC port is connected with an embedded memory 1004, the IFC port is connected with a first flash memory 1005, and the QSPI port is connected with a second flash memory 1006. In practical applications, the first flash 1005 may be NAND FLASH, the second flash 1006 may be QSPI FLASH, the ram 1003 may be DDR4 SDRAM, the SPI pin 1002 may be an SPI pin, and the embedded memory 1004 may be an emmc (embedded multi media card) memory.

In an optional embodiment, the firewall device of the present application may further include: a transformer 520. Wherein the transformer 520 may be arranged directly inside the second type of network port.

In an alternative embodiment, the transformer 520 may also be provided between the first type network port 510 and the network adapter 500, or between the first type network port 510 and the third chip 600. Specifically, fig. 4 shows a partial structure diagram of a firewall device according to an embodiment of the present invention, as shown in fig. 4, the processor 200 is connected to the second chip 400, four network adapters 500 are distributed and connected to the second chip 400, each network adapter 500 is connected to a transformer 520, and each transformer 520 is further connected to a second type port 510, and the transformer 520 may be used to adjust a voltage between the network adapter 500 and the second type port 510.

In an alternative embodiment, a reset button is further disposed on the processor 200, and the reset button is used for resetting the first chip, the second chip, and the third chips. A clock buffer is further disposed on the second chip 400 for time synchronization of the second chip 400.

According to the firewall device, various types of internet access expansion are performed on the LS1046A processor, so that the use of the firewall device in more application scenes is met.

The above embodiment numbers of the present invention are only for description, and do not represent the advantages and disadvantages of the embodiments.

In the above embodiments of the present invention, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to the related descriptions of other embodiments.

In the embodiments provided in the present application, it should be understood that the disclosed technical content can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, a division of a unit may be a division of a logic function, and an actual implementation may have another division, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or may not be executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present invention may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present invention, which are essential or contributing to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.

The foregoing is only a preferred embodiment of the present invention, and it should be noted that, for those skilled in the art, a plurality of improvements and decorations can be made without departing from the principle of the present invention, and these improvements and decorations should also be regarded as the protection scope of the present invention.

Claims (10)

1. A firewall device, comprising:

a main board (100);

the processor (200) is arranged on the main board (100) and used for receiving network data and filtering abnormal information in the network data;

the first chip (300) is arranged on the mainboard (100) and connected with the processor (200) through a first serial bus (211), wherein a plurality of first type network ports (310) are arranged on the first chip (300), and the first type network ports (310) are network ports for receiving optical signals;

the second chip (400) is arranged on the main board (100) and connected with the processor (200) through a serial computer expansion bus (241), wherein a plurality of connection ports (410) used for connecting network adapters (500) are arranged on the second chip (400), each network adapter (500) is provided with a second type network port (510), and the second type network ports (510) are network ports used for receiving electric signals.

2. The firewall device according to claim 1, further comprising:

and a plurality of third chips (600) arranged on the main board (100) and connected with the processor (200), wherein each third chip (600) is provided with a second type network port (510).

3. Firewall apparatus according to claim 2, wherein the processor (200) comprises:

a first port (210) connected to the first chip (300) through the first serial bus (211), wherein a communication protocol of the first port (210) corresponds to a communication protocol of the first serial bus (211);

a second port (220) connected to at least two third chips (600) via a parallel bus (221), wherein a communication protocol of the second port (220) corresponds to a communication protocol of the parallel bus (221);

a third port (230) connected to one of the third chips (600) through a second serial bus (231), wherein a communication protocol of the third port (230) corresponds to a communication protocol of the second serial bus (231), the second serial bus (231) is a one-way transmission serial bus, and the first serial bus (211) is a four-way transmission serial bus;

a fourth port (240) connected to the second chip (400) via the serial computer expansion bus (241), wherein a communication protocol of the fourth port (240) corresponds to a communication protocol of the serial computer expansion bus (241).

4. The firewall device of claim 1, further comprising:

and the timer (1001) is arranged on the main board (100), is connected with the processor (200) and is used for configuring the time information of the processor (200).

5. The firewall device of claim 1, further comprising:

and the clock buffer is arranged on the second chip (400) and used for carrying out time synchronization on the second chip (400).

6. The firewall device of claim 2, further comprising:

and the reset button is arranged on the main board (100) and is used for resetting the first chip, the second chip and the third chips.

7. The firewall device according to claim 1, further comprising:

and the expansion slot (700) is arranged on the mainboard (100), wherein the expansion slot (700) is used for connecting a plurality of firewall devices in parallel.

8. The firewall device of claim 1, further comprising:

and the storage device (800) is connected with the processor (200) and is used for storing the processing information generated after the processor (200) processes the network data.

9. The firewall device according to claim 1, further comprising:

the universal serial interfaces (250) are arranged on the processor (200), wherein the universal serial interfaces (250) are connected with an external input device (1007) through a universal serial bus, and the universal serial interfaces (250) are used for receiving input information sent by the external input device (1007).

10. The firewall device of claim 1, further comprising:

and the indicator lamp (900) is connected with the processor (200) and is used for generating different light information according to the state information of the processor (200).

Images