FR2862398A1 - Ethernet interfaces connection device for Ethernet network, has two transceivers, where external transmit terminals of one transceiver are kept disconnected from terminals of another transceiver - Google Patents

Abstract

The device has two transceivers (5.1, 5.2), where external transmit terminals (9.1) of the transceiver (5.1) are connected to external receive terminals (10.2) of the transceiver (5.2). A line-integrity signal transmit unit is connected to external receive terminals (10.1) of the transceiver (5.1). The transmit terminals (9.1) of the transceiver (5.1) are kept disconnected from the terminals (10.2) of the transceiver (5.2).

Description

The present invention relates to a unidirectional connecting device

  usable in an ETHERNET network.

BACKGROUND OF LINVENTION

  It is known to connect a first computer and a second computer to each other to associate with these computers a first ETHERNET interface and a second ETHERNET interface which each comprise a transmission-reception module, commonly called a transceiver (or transceiver ), provided with external message transmission terminals and ex-dull message receiving terminals. A link is established between the two interfaces by means of a cable arranged between the external transmission terminals of the transceiver of the first interface and the external reception terminals of the transceiver of the second interface, and a cable arranged between the external receiver terminals of the transceiver of the first interface and the external transmission terminals of the transceiver of the second interface. ETHERNET networks are particularly reliable and allow relatively high flows.

  It may happen that it is desired to restrict the passage of information from the second computer to the first computer in order, for example, to prevent a user of the second computer from accessing information from the first computer, causing malfunctions of the first computer. computer or take control of it. This is the case for example when the first computer is part of a highly secure network while the second computer is part of a weakly secure network.

  It is then known to connect the first computer and the second computer to a protection device of the "firewall" type, which filters the messages passing through it between the two computers. Such a device provides only a relative security and there is a risk that unauthorized messages can pass from the second computer to the first computer despite the protection device. These devices are also relatively complex to implement.

  It was thought to interrupt the link transmitting the messages from the second computer to the first computer. However, in an ETHERNET network, the ETHERNET interfaces check for the presence of a line signal (or presence signal) at the external reception terminals of the transceiver before sending a message. Removing the link allowing the message transmission from the second computer to the first computer prevents verification of the existence of this signal.

  It is then necessary to modify the structure of the ETHERNET interface and the software ensuring its operation-ment to allow the first computer to send its message even if the line integrity signal is not detected. These modifications are relatively heavy and may affect the reliability of the ETHERNET link.

  OBJECT OF THE INVENTION An object of the invention is to propose a unidirectional link between two ETHERNET interfaces that is simple and reliable.

  BRIEF SUMMARY OF THE INVENTION For this purpose, according to the invention, a unidirectional connection device is provided between at least a first ETHERNET interface and a second ETHERNET interface, which respectively comprise a first transceiver and a second transceiver each provided with terminals. external transmission of message and external message receiving terminals, the device comprising a connecting member of the external transmission terminals of the first transceiver to the external reception terminals of the second transceiver and a transmission member of a signal of integrity of the line connected to the external reception terminals of the first transceiver, the external transmission terminals of the second transceiver being kept disconnected from the external reception terminals of the first transceiver.

  Thus, a line integrity signal is transmitted to the first ETHERNET interface so that the absence of connection between the external transmission terminals of the second transceiver and the ex-dull reception terminals of the first transceiver does not affect the operation. of the first ETHERNET interface. This lack of connection makes it possible to limit the risk of unauthorized information passing from the second ETHERNET interface to the first ETHERNET interface.

  According to a first embodiment, the link member comprises an analog amplifier connected to the first transceiver and the second transceiver to amplify the message from the first transceiver towards the second transceiver.

  The amplifier prevents the link normally used to transmit messages from the first transceiver to the second transceiver is used for the transit of information from the second transceiver to the first transceiver.

  Preferably then, the transmitting member comprises a branch connecting an output of the analog amplifier to the external receiving terminals of the first transceiver.

  The line integrity signal from the external transmission terminals of the first transceiver is then returned to its external reception terminals. The transmitting member is then of particularly simple structure.

  In a variant, the transmission device comprises a transceiver having external transmission terminals connected to the external reception terminals of the first transceiver.

  The transceiver of the transmitting member is then used only to transmit the line integrity signal to the first transceiver of the first ETHERNET interface. Such a component is relatively inexpensive and customary in the field of ETHERNET networks, which facilitates its implementation.

  According to a second particular embodiment, the device comprises a third transceiver having external transmission terminals and external reception terminals respectively connected to the external reception terminals and to the external transmission terminals of the first transceiver, a fourth transceiver having terminals of external transmission and external receiving terminals respectively connected to the external receiving terminals and the external transmission terminals of the second transceiver, the third transceiver having internal transmission terminals connected to internal receiving terminals of the fourth transceiver via a buffer memory and internal receiving terminals held disconnected from the internal transmission terminals of the fourth transceiver.

  The third transceiver transmits the line integrity signal to the first transceiver. The buffer memory makes it possible to adapt the bit rate of the internal transmission terminals of the third transceiver to the bit rate of the internal reception terminals of the fourth transceiver and also allows a repetition of the message. The buffer makes it possible to overcome the problems of desynchronization between the clock of the third transceiver and the clock of the fourth transceiver. The links between the third transceiver and the fourth transceiver and the buffer are generally formed of xMII buses which are unidirectional by design. These links can not be used to transmit messages from the second computer to the first computer.

  Advantageously, the first interface being associated with a first device comprising a discrete signal input port and the second interface being associated with a second device comprising a discrete signal output port, the device comprises a link signal connected to these ports and provided with a low-pass filter preferably arranged to pass the signals of lower frequency to about one hertz.

  It is thus possible to send acknowledgments or test signals from the second equipment to the first device. However, the low-pass filter prevents the passage of elaborate signals that could be used to cause a malfunction of the first equipment.

  Other features and advantages of the invention will become apparent on reading the following description of particular non-limiting embodiments of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

  Reference is made to the accompanying drawings, in which: FIG. 1 is a schematic view of a network in which a device according to the invention is implanted; FIG. 2 is a schematic view of such a device, according to a first embodiment, - Figure 3 is a schematic view of a first alternative embodiment of the device according to the first embodiment, - Figure 4 is a schematic view of a second embodiment of the device according to the first embodiment; embodiment of the invention, - Figure 5 is a schematic view of such a device, according to a second embodiment. DETAILED DESCRIPTION OF THE INVENTION Referring to Figure 1, the unidirectional connecting device according to the invention is generally designated 1.

  The unidirectional link device 1 is arranged between two computers 2.1 and 2.2 (in the following description, the indices .1 and .2 designate elements in relation to computers 2.1 and 2.2 respectively). Computers 2.1, 2.2 can be part of each network.

  Computers 2.1 and 2.2 are each equipped with ETHERNET interfaces generally designated in 3.1 and 3.2.

  The ETHERNET interface 3.1 comprises, in a manner known per se, an access control module 4.1 (commonly called MAC (abbreviation for "Media Access Control") connected on the one hand to the computer 2.1 and on the other hand to Transceiver 5.1 The transceiver 5.1 comprises internal message transmission terminals 6.1 and internal message receiving terminals 7.1 connected via xMII 8.1 buses to access control module 4.1 The transceiver 5.1 also includes signal terminals. external transmission 9.1 connected via an isolating transformer 11.1 to an output connector 12.1 and external receiving terminals 10.1 connected via an isolating transformer 81.1 to a connection connector. entry 13.1.

  The ETHERNET 3.2 interface has the same structure as that of the ETHERNET 3.1 interface. The structure and operation of the ETHERNET 3 interfaces are classic. The ETHERNET 3 interfaces allow messages to be passed between them. The messages transiting through an ETHERNET link are commonly called frames and include in particular addressing information relating to the source of the message and the recipient thereof, control information (data type, message length, etc.) and the data itself.

  The connection device 1 comprises input connectors 14.1, 14.2 respectively connected to the output connectors 12.1, 12.2 of the ETHERNET interfaces 3.1, 3.2 by pairs of twisted cables 16.1, 16.2. The connection device 1 also comprises output connectors 15.1, 15.2 respectively connected to the input connectors 13.1, 13.2 of the ETHERNET interfaces 3.1, 3.2 by pairs of twisted cables 17.1, 17.2.

  A first embodiment of the connecting device 1 will now be described.

  With particular reference to FIG. 2, the connection device 1 comprises, in accordance with the first embodiment of the invention, an analog amplifier 18 connected by means of isolation transformers 19 to the connector input 14.1 and the output connector 15.2 for amplifying the messages from the computer 2.1 to the computer 2.2.

  The connection device 1 also comprises a load 20 connected to the input connector 14.2 makes it possible to perform an impedance matching.

  The link device 1 further comprises a line integrity signal source 21 connected through an isolation transformer 22 to the connector 15.1. The line integrity signal source 21 supplies to the external reception terminals 10.1 of the transceiver 5.1 a signal identical to the line integrity signal or presence signal normally generated by the tranceivers. The line integrity signal source 21 is here a transceiver whose external transmission terminals are connected to the connector 15.1 via the transformer 22.

  A message from the computer 2.1 is transmitted in the ETHERNET interface 3.1 to the access control module 4.1 and then to the transceiver 5.1. After checking the presence of the line integrity signal at the external reception terminals 10.1, the message is transmitted from the external transmission terminals 9.1 to the connection device 1 where the message is amplified by the amplifier 18 before being transmitted. at the ETHERNET 3.2 interface and then to the 2.2 computer.

  There is no connection between the input connector 14.2 and the output connector 15.1 so that the external transmission terminals 9.2 of the transceiver 5.2 are disconnected from the external receiving terminals 10.1 of the transceiver 5.1. No message transmitted from the external transmission terminals 9.2 can therefore arrive at the external reception terminals 10.1.

  The amplifier 18 further prohibits the link between the external transmission terminals 9.1 of the transceiver 5.1 and the external reception terminals 10.2 of the transceiver 5.2 to be used for the passage of a message from the ETHERNET interface 3.2 to the ETHERNET interface 3.1.

  On the other hand, the computer 2.1 comprises a reception port 51 of discrete signals and the computer 2.2 comprises a transmission port 52 of discrete signals.

  The connection device 1 comprises a low-pass filter 53 connected to the transmission port 52 of the computer 2.2 and to the reception port 51 of the computer 2.1 for passing signals having a frequency less than or equal to one hertz. These signals can be used to test the unidirectional link and for example verify that a message sent by the computer 2.1 has been received by the computer 2.2. The low-pass filter 53 prevents the passage of advanced signals, which would necessarily have a frequency greater than one hertz, so that it is not possible from the second computer to control or cause malfunctions on the first computer. by this low frequency link.

  According to a first variant, according to FIG. 3 (the diagram of FIG. 3 is a simplified representation of a part of the diagram of FIG. 2), the input connector 14.2 is connected via an isolation transformer 23 to a switch 24 mounted between the line integrity signal source 21 and the isolation transformer 22. The switch 24 has a first state in which the voltage source 21 is connected to the output connector 15.1 via the transformation. 22 and a second state in which the input connector 14.2 is connected to the output connector 15.1 via the transformer 21.

  A switch 25 is also disposed between the line integrity signal source 21 and the power supply 26 thereof.

  A controller 27, such as a three-position rotary knob, is connected to switch 24 and switch 25 to control them.

  The controller 27 has three selectively activatable states, namely: - a blocking state of the link in which the switch 24 is in its first state and the switch 25 is open so that the input connector 14.2 is disconnected from the output connector 15.1 and that, since the line integrity signal source 21 is not powered, the line integrity signal is not transmitted to the output connector 15.1 and the transceiver 5.1 can not function.

  a unidirectional link state in which the switch 22 is in its first position and the switch 23 is closed so that the input connector 14.2 is disconnected from the output connector 15.1 and the signal source of integrity line 21 is powered and transmits the line integrity signal to the output connector 15.1. Only the connection of the computer 2.1 to the computer 2. 2 is then possible.

  a bidirectional link state in which the switch 22 is in its second state so that the input connector 14.2 is connected to the output connector 15.1 thus enabling the transmission of messages from the computer 2.1 to the computer 2.2 and the transmission of messages from computer 2.2 to computer 2.1.

  In a second variant shown in FIG. 4, the line integrity signal transmitting member comprises a branch 60 which extends between the output of the analog amplifier 18 and the isolation transformer 22.

  Thus, the line integrity signal and the messages transmitted from the external transmission terminals of the transceiver 5.1 are transmitted both to the external reception terminals of the transceiver 5. 2 but also to the external reception terminals of the transceiver 5.1 via 60. The messages that are not intended for the computer 2.1 will not be taken into account.

  In this variant, it is also possible to check in a simple manner the operation of the message transmission chain between the computer 2.1 and the analog amplifier 18 by sending from the computer 2.1 a message addressed to the computer 2.1 which will come back to it by the derivation 60.

  A second embodiment of the connecting device 1 will now be described. Only the references of the internal elements of the connection device 1 are modified (the references of the input and output connectors 14.1, 14.2, 15.1, 15.2, and the low-pass filter 53 are however preserved).

  With reference to FIG. 3, the connection device 1 comprises, according to the second embodiment of the invention, a transceiver 30 having external reception terminals 31 connected by an isolation transformer 32 to the input connector 14.1. and external transmission terminals 33 connected by an isolation transformer 34 to the output connector 15.1. The transceiver 30 also includes internal transmission terminals 35 connected via an xMII bus 36 to a buffer 38 and internal receiving terminals 37 not connected.

  The connection device comprises a transceiver 40 comprising external reception terminals 41 connected via an isolation transformer 42 to the input connector 14.2 and external transmission terminals 43 connected via a transformer. isolation 44 to the output connector 14.2. The transceiver 40 also comprises internal transmission terminals 45 that are not connected and internal reception terminals 47 connected via an xMII bus 46 to the buffer memory 38.

  The transceiver 30 transmits via its external transmission terminals 33 a carrier to the output connector 15.1 and thus to the external reception terminals 10.1 of the transceiver 5.1.

  The buffer memory 37 makes it possible to adapt the rate of the internal transmission terminals 35 of the transceiver 30 to the internal reception terminals 47 of the transceiver 40 and also allows a repetition of the message. The xMII buses 36 and 46 are unidirectional in design and can not be used to send a message from the ETHERNET interface 3.2 to the ETHERNET 3.1 interface.

  Since the internal transmission terminals 45 of the transceiver 40 are not connected to the internal receiving terminals 37 of the transceiver 30, there is no connection between the input connector 14.2 and the output connector 15.1. The external transmission terminals 9.2 of the transceiver 5.2 of the ETHERNET interface 3.2 are thus disconnected from the external reception terminals 10.1 of the transceiver 5.1 of the ETHERNET interface 3.1 so that no message can pass from the ETHERNET interface 3.2 to the ETHERNET interface 3.1.

  On the other hand, the external transmission terminals 33 of the transceiver 30 are connected to the external reception terminals 10.1 of the transceiver 5.1 of the ETHERNET interface 3.1 and transmit to them the line integrity signal.

  On the other hand, the computer 2.1 comprises a reception port 51 of discrete signals and the computer 2.2 comprises a transmission port 52 of discrete signals.

  The connection device 1 comprises a low-pass filter 53 connected to the transmission port 52 of the computer 2.2 and to the reception port 51 of the computer 2.1 for passing signals having a frequency less than or equal to one hertz. These signals can be used to test the unidirectional link and for example verify that a message sent by the computer 2.1 has been received by the computer 2.2. The low-pass filter 53 prevents the passage of advanced signals, which would necessarily have a frequency greater than one hertz, so that it is not possible from the second computer to control or cause malfunctions on the first computer by this low frequency link.

  Of course, the invention is not limited to the embodiments described and variants can be made without departing from the scope of the invention as defined by the claims.

  In particular, the scheme of the connecting device may be different from that described. For example, in the first embodiment, the connection device may be devoid of an analog amplifier between the connectors 14.1, 15.2 (the irreversible character of the unidirectional link is then provided in a less reliable manner). In the second embodiment, switches may be provided between the transformer 42 and the external receiving terminals 41 and between the transformer 34 and the external transmission terminals 33 to allow the choice to be made either direct connection between the connectors 14.2 and 15.1 for the transmission of messages from the computer 2.2 to the computer 2.1, ie the interruption of this link (the transceiver 30 then constituting the source of the line integrity signal ).

  Although in the described embodiments, the ETHERNET interfaces are associated with computers, the ETHERNET interfaces may be associated with any network equipment and in particular a router, a computer, a bridge, a switch or the like.

  Although the invention has been described more particularly for application to a 100 base TX link, the invention is also applicable to other types of ETHERNET networks and in particular 10 megabit networks, or with some modifications to the 1000 megabit networks or fiber optic.

Claims (7)

  1. Unidirectional connection device between at least a first ETHERNET interface and a second ETHERNET interface (3.1, 3.2) which respectively comprise a first transmitter-transmitter (5.1) and a second transmitter-transmitter (5.2) each provided with terminals external transmission of messages (9.1, 9.2) and external message receiving terminals (10.1, 10.2), characterized in that the device comprises a connecting member (18; 30, 36, 37, 46, 40) of the terminals of external transmission of the first transmitter-transmitter to the external reception terminals of the second transmitter-transmitter and a transmission member (21; 30) of a line integrity signal connected to the external reception terminals of the first transmitter-transmitter, the external transmission terminals of the second transmitter-transmitter being kept disconnected from the external receiving terminals of the first transmitter-transmitter.   2. Connection device according to claim 1, characterized in that the connecting member comprises an analog amplifier (18) connected to the first transmitter-transmitter (5.1) and the second transmitter-transmitter (5.2) to amplify the message from the first transmitter-transmitter towards the second transmitter-transmitter.   Connecting device according to claim 2, characterized in that the transmitting member comprises a branch (60) connecting an output of the analog amplifier (18) to the external receiving terminals (9.1) of the first transmitter-transmitter. (5.1).   4. Connecting device according to claim 2, characterized in that the transmitting member comprises a transmitter-transmitter (21) having external transmission terminals connected to the external receiving terminals 2862398 (10.1) of the first transmitter transmitter (5.1).   Connecting device according to claim 1, characterized in that it comprises a third transmitter-transmitter (30) having external transmission terminals (33) and external reception terminals (31) respectively connected to the external reception terminals. (10.1) and to the external transmission terminals (9.1) of the first transmitter-transmitter (5.1), a fourth transmitter-transmitter (40) having external transmission terminals (43) and respective external reception terminals (41). connected to the external receiving terminals (10.2) and to the external transmission terminals (9.2) of the second transmitter-transmitter (5.2), the third transmitter-transmitter having internal transmission terminals (35) connected to terminals of internal reception (47) of the fourth transmitter-transmitter via a buffer (38) and internal receiving terminals (37) kept disconnected from the internal transmission terminals (45) of the fourth transmitter-transmitter; director.   6. Connecting device according to claim 1, characterized in that the first interface being associated with a first computer (2.1) comprising an input port (51) of discrete signals and the second inter-face being associated with a second computer (2.2) comprising an output port (52) of discrete signals, the device comprises a link member connected to these ports and provided with a low-pass filter (53).   7. Connecting device according to claim 6, characterized in that the low-pass filter (53) is arranged to let the signals of frequency less than about one hertz.