JP2022029303A - One-way communication device - Google Patents

Abstract

To provide a technology that ensures data unidirectionality and smoothly executes communication negotiations between devices that require data unidirectionality.SOLUTION: There is provided a communication device that can transmit data from a first device to a second device but cannot transmit data from the second device to the first device. The second device includes a second PHY that receives an electric signal from the first device by the second receiving device and converts the electric signal into a receiving frame. The first device includes a first PHY that converts a transmission frame transmitted from the first device into an electric signal, and a dummy nego PHY for realizing pseudo-negotiation with the second device. The dummy nego PHY includes a pseudo transmission device having the same structure as the second transmission device in which the second PHY converts a transmission frame to be transmitted from the second device into an electric signal.SELECTED DRAWING: Figure 4

Description

The present invention relates to a communication technique for ensuring unidirectionality of data and facilitating communication negotiation between a transmitting device and a receiving device.

A technology that prevents unauthorized intrusion from an external system and protects the data of the internal system from the external system is important as a system capable of two-way communication.
Due to such needs, data diode devices have been provided in which data can flow completely in only one direction through the communication path of the gateway.

The data diode device is a device provided with a transmission device, a one-way transmission line, and a reception device for the purpose of security measures so that data can flow completely in only one direction through the communication path of the gateway. By completely blocking the flow of data in the reverse direction, it is possible to prevent virus attacks and hacking on connected devices (see FIGS. 1 and 2).

For example, in Patent Document 1, "a physical prevention mechanism is adopted as a technique for providing a more secure data communication method against an attack on a computer, that is, from an external system. One-way communication is realized by eliminating the signal line for transmitting data to the internal system, and external attacks on the internal system are prevented.

In addition, in Patent Document 1, "Since the link test does not pass if one side of the communication line compliant with 10BASE-T of IEEE802.3 is excluded, the transmission signal of the data transmission processing unit is folded back and used as a reception signal". It is described in the example.

Auto-negotiation will be described with reference to FIG.
It is assumed that the device A can execute half-duplex communication or full-duplex communication at 10 Mbps and half-duplex communication or full-duplex communication at 100 Mbps. It is assumed that the device B can execute half-duplex communication or full-duplex communication at 100 Mbps and half-duplex communication or full-duplex communication at 1 Gbps.
When the device A and the device B are connected by a bidirectional cable, auto-negotiation automatically selects and communicates with half-duplex communication or full-duplex communication at 100 Mbps.

Patent Document 2 discloses a technique capable of preventing unauthorized intrusion from an external system and safely providing data of the internal system to the external system. That is, in order to realize one-way data (electrical signal), a general-purpose MAC (IC) is used, and the assembly procedure of connecting the first MAC to the ground and opening the second MAC is performed. ..

Patent Document 3 is an improved technique of the technique disclosed in Patent Document 2. That is, a data diode that can secure one-way data without using a general-purpose MAC (IC) in a special way or assembling it is disclosed.

Japanese Unexamined Patent Publication No. 2010-199943 Japanese Unexamined Patent Publication No. 2016-072713 JP-A-2019-62429

When a one-way cable for physically realizing one-way data is adopted, auto-negotiation cannot be established. Therefore, the communication method cannot be matched to the one-way communication path to be realized, and communication cannot be secured.
However, since the devices for realizing the one-way data (opposite devices) may be connected after determining each other's communication method in advance, it is not necessary to automate the negotiation.

An object to be solved by the present invention is to provide a technique for ensuring data unidirectionality and smoothly executing communication negotiations between devices that require data unidirectionality.

(First invention)
The first invention relates to a one-way communication device capable of transmitting data from the first device to the second device but unable to transmit data from the second device to the first device.
The second device includes a second PHY that receives an electric signal from the first device by the second receiving device and converts it into a receiving frame.
The first device includes a first PHY that converts a transmission frame transmitted from the first device into an electric signal.
It is provided with a dummy negotiation PHY for simulating negotiation with the second device.
The dummy nego PHY includes a pseudo transmission device (driver) having the same structure as the second transmission device that converts the transmission frame to be transmitted from the second device into an electric signal by the second PHY.
The first PHY is a one-way communication device provided with a first receiving device (receiver) for receiving an electric signal from the pseudo transmitting device (see FIG. 4).

(Glossary)
The "data", "file", "frame", and "error detection code" are all "logical signals". Further, the "frame" includes a frame as a data format and data applied to the frame.
The "PHY" is an IC that processes the physical layer protocol.

(Action)
The first device converts the transmission frame into an electric signal in the first PHY and transmits it to the second device in the first transmission device. The second PHY of the second device converts the received electric signal into a receiving frame.
The dummy nego PHY uses a transmission frame to be transmitted from the second device as an electric signal. Then, the electric signal is transmitted to the first receiving device of the first PHY by the pseudo transmitting device. As the first device, the negotiation with the second device can be completed in a pseudo manner.

Although the transmission frame can be transmitted from the first device to the second device, there is no means for transmitting the transmission frame from the second device to the first device. Therefore, the data transmission between the first device and the second device is one-way from the first device to the second device, and the security of the first device is ensured.

(Variation 1 of the first invention)
The first invention may be formed as follows.
That is, the first PHY includes a first transmission device for transmitting the electric signal converted by the first PHY to the second device.
The second PHY includes a second receiving device for receiving an electric signal transmitted from the first transmitting device.
The first transmitting device and the second receiving device are connected by a one-way communication cable in which an electric signal flows in one direction from the first transmitting device to the second receiving device. (See FIGS. 4 and 5).

(Variation 1 of the first invention)
The first invention may be formed as follows.
That is, when the second PHY is provided with the second transmitter (driver) in advance, the second transmitter is set as open.
When the dummy nego PHY is provided with a pseudo receiving device (receiver) in advance, the pseudo receiving device is set as reception from the ground (see FIG. 5).

According to the first invention, it is possible to provide a one-way communication device for smoothly executing communication negotiation and ensuring data one-way between devices that require data one-way. ..

It is a figure which shows the prior art. It is a figure which shows the prior art. It is a conceptual diagram showing auto-negotiation. It is a conceptual diagram which shows the 1st Embodiment in this invention. It is a conceptual diagram which shows the 2nd Embodiment in this invention. It is a table (a) which shows the structure of an Ethernet RJ45 connector pin assignment, and the figure (b) of a concrete cable. It is a conceptual diagram which shows the 3rd Embodiment in this invention.

Hereinafter, the present invention will be described based on the embodiments. The drawings used here are FIGS. 4 to 7. Further, if necessary, FIGS. 1 to 3 showing the prior art are compared and referred to.

(Fig. 4)
FIG. 4 is a block diagram conceptually showing the main part of the present invention.
As a premise, data is transmitted only in one direction from the first device to the second device. The first device has a physical structure that does not receive any data from the second device.

The first device includes a PHY-1 and a dummy nego PHY. The "PHY" is an IC that processes the protocol of the physical layer, and is provided with a driver that performs a data transmission function and a receiver that performs a data reception function.

The second device is equipped with a PHY-2, which also has a driver for a data transmission function and a receiver for a data reception function.

The driver of PHY-1 (first transmitter) and the receiver of PHY-2 (second receiver) are connected by a one-way cable. Nothing is connected to the PHY-2 driver. This results in a physical structure in which data is transmitted from the first device to the second device in only one direction.

The dummy nego PHY driver described as being provided in the first device employs the same physical one as the PHY-2 driver in the second device and is electrically connected to the PHY-1 receiver. By receiving the data (electrical signal) transmitted from the driver of this dummy negotiation PHY by the receiver of the PHY-1, the first apparatus can complete the pseudo-negotiation with the second apparatus.

After the pseudo-negotiation is completed, the PHY-1 driver can select a predetermined communication speed and communication mode for the second device and transmit data. However, since the first device does not receive the signal from the second device, the first device functions as a data diode with respect to the second device.

For example, in the technique disclosed in Patent Document 1, when the 10BASE-T of IEEE802.3 is folded back and connected to the opposite device, the line impedances do not match and the electric signal waveform may be distorted. If the electrical signal waveform is distorted, the link test will pass, but there may be an error in data transmission.

On the other hand, in the above-described embodiment, 100BASE-TX of IEEE802.3u is applied, and the connection is supported. Since the PHY-1 driver and receiver are connected one-to-one, the above problems do not occur.

(Fig. 5)
The second embodiment shown in FIG. 5 is a modification of the embodiment shown in FIG.
Although "GND" is displayed in the figure, the voltage as a digital circuit is maintained and malfunction is prevented by connecting (pulling down) the receiver of the dummy nego PHY to the ground.

Also, the driver of the PHY-2 in the second device is "open", that is, physically closed, and is substantially terminated. This ensures one direction of data transmission from the first device to the second device.

(Fig. 6)
FIG. 6 shows a specific state when the first device as the control system side and the second device as the controlled information system side are connected by a one-way cable.

Ethernet RJ45 is adopted as the one-way cable, and the connector pin assignment is as follows.
That is, as shown in FIG. 6A, only pin numbers 1 and 2 are adopted in the first device so that the output signal can be transmitted, and only pin numbers 1 and 2 are adopted in the second device. Pin numbers 3 and 6 are cut. As a result, the input signal can be received and the signal from the second device to the first device is cut off.

FIG. 6B shows which pins are connected and which are disconnected in the crossover cable.
That is, the pin 1 on the first device side is connected to the pin 3 on the second device side, and the pin 2 on the first device side is connected to the pin 6 on the second device side. Further, the pin 3 on the first device side and the pin 1 on the second device side are cut off, and the pin 6 on the first device side and the pin 2 on the second device side are cut off.

(Fig. 7)
FIG. 7 shows the conceptual blocks shown in FIGS. 4 and 5 as more specific devices.

The first device is a device for sending a transmission file from the protocol termination _1 to the second device. The file for transmission is converted into data for transmission by the file transmission means and passed to the first MAC.
Here, the “MAC” is an IC that processes the protocol of the Medium Access Control (MAC) layer.

The communication frame processed by the first MAC is sent to PHY-1 and converted into a logical signal of the transmission frame, and transmitted from the PHY-1 driver to the PHY-2 receiver via the one-way communication cable. To.

The logic signal of the transmission frame received by the receiver of the PHY-2 is converted into the reception frame by the PHY-2 and sent to the second MAC. In the second MAC, the receiving frame is converted into the receiving data. Then, the file receiving means receives the receiving data and reaches the protocol terminal _2 as a receiving file.

According to the one-way communication device incorporated as a part of the first device and the second device, the unidirectionality of the data is ensured between the protocol termination _1 and the protocol termination _2. This ensures the quality of data transmission from protocol termination _1 to protocol termination _2 while protecting the first device, which is the control system, from the external system. Data can be transmitted by selecting the optimum communication speed and communication mode in the first device and the second device.

According to the above-described embodiment, media conversion (E / O, O / E) is performed by unidirectionalizing data by the Ethernet physical layer between the first device (transmitting device) and the second device (receiving device). I was able to realize it without doing. That is, it has been possible to provide a one-way communication device capable of ensuring one-way data and smoothly executing communication negotiations between devices that require one-way data.

The present invention has potential in the information and communication equipment manufacturing industry, the information and communication service industry including the information and communication equipment installation service industry, the software industry for creating computer software for information and communication services, and the like.

Claims (3)

A one-way communication device that can transmit data from the first device to the second device but cannot transmit data from the second device to the first device.
The second device includes a second PHY that receives an electric signal from the first device by the second receiving device and converts it into a receiving frame.
The first device includes a first PHY that converts a transmission frame transmitted from the first device into an electric signal.
A dummy negotiation PHY for realizing a pseudo-negotiation with the second device is provided.
The dummy nego PHY includes a pseudo transmission device having the same structure as the second transmission device in which the second PHY converts a transmission frame to be transmitted from the second device into an electric signal.
The first PHY is a one-way communication device including a first receiving device for receiving an electric signal from the pseudo transmitting device. The first PHY includes a first transmission device for transmitting the electric signal converted by the first PHY to the second device.
The second PHY includes a second receiving device for receiving an electric signal transmitted from the first transmitting device.
The one-way according to claim 1, wherein the first transmitting device and the second receiving device are connected from the first transmitting device to the second receiving device by a one-way cable through which an electric signal flows in one direction. Communication device. When the second PHY is provided with the second transmitter in advance, the second transmitter is set as open and set as open.
The one-way communication device according to claim 1 or 2, wherein when the dummy nego PHY is provided with a pseudo receiving device in advance, the pseudo receiving device is set to receive from the ground.

Images