KR20080050245A - Ethernet-based stand-alone network security system - Google Patents

Abstract

An Ethernet-based stand-alone type network security system is provided to enable a manager to easily manage a system by mounting a storage unit for storing a huge amount of log information for system monitoring. A control processing unit(200) controls an operation of an overall system and manages a state of the system. A network processing unit(300) performs a traffic management function by interworking with the control processing unit, and outputs switching/routing path information obtained by performing the traffic management function to a corresponding line interface or a monitor interface, or perform a reverse function. An Ethernet physical layer unit(400) includes a line interface connected with an external network and a monitor interface(741) connected with the control processing unit, restores a line interface signal or a monitor interface signal to a physical layer signal, and transfers the restored signal to the network processing unit, or performs a reverse function. A storage unit(500) receives log information for system monitoring from the control processing unit, and stores the same.

Description

Ethernet-based stand-alone network security system

The present invention analyzes the information from the second layer to the seventh layer from packets received through the line interface as well as high-speed switching / routing, and based on this, Ethernet-based structure that can design a security system in a manner desired by the user. A stand-alone network security system.

The present invention is derived from a study conducted as part of the IT new growth engine core technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development (Task Management Number: 2005-S-101-02, Title: Multimedia QoS Routing Technology).

Network security equipment has been developed based on application specific integrated circuits, which are primarily used to produce products that perform some specific network security functions.

However, Ethernet is being used as an interface of most security equipments recently, various service needs of network users are increasing, IPv4-IPv6 conversion is required, and security (procedure server, firewall, virtual private network) is diversified. There are demands for different requirements and different applications such as thin.

However, on the existing network platform, various service needs, IPv4-IPv6 conversion request, security (procedure server, firewall, virtual private network) functions of the above-mentioned network users are diversified, and various demands and acceptance requirements for various applications are provided. There is a problem that cannot be satisfied.

As a means to solve the above problems, the present invention analyzes the information from the second layer to the seventh layer from the packet received through the line interface as well as high-speed switching / routing, and based on this design the security system as the user wants An Ethernet-based stand-alone network security system is provided.

According to an embodiment of the present invention, the Ethernet-based stand-alone network security system includes: control processing means for performing operation control and state management of the entire system; Network processing means for performing a traffic management function in association with the control processing means and outputting the resulting switching / routing path information to a corresponding line interface or monitor interface or performing the reverse function; A line interface connected to an external network and a monitor interface connected to an external network or the control processing means to restore the line interface signal or the monitor interface signal to a physical layer signal and then transfer the signal to the network processing means or vice versa. Ethernet physical layer means for performing; And storage means for receiving and storing log information for a system monitor from the control processing means.

The network security system according to the present invention further includes a power supply and fan means for supplying power to the control processing means, the network processing means, the Ethernet physical layer means and the storage means, and performing a system internal temperature control function. can do.

According to the above, the Ethernet-based stand-alone network security system according to the present invention connects the network processor means and the control processor means separately with a 1000BASE-T interface of 1 Gbps speed so that a protocol that cannot be handled by the network processor can be fast. The system can be easily managed by administrators by installing a storage means that can be processed and monitored, and can store a large amount of log information for system monitoring. By reducing the number of board stacks, the implementation and testability can be improved, and the system cost can be lowered.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

In addition, throughout the specification, when a part is 'connected' to another part, it is not only 'directly connected' but also 'indirectly connected' with another element in between. Include. In addition, the term 'comprising' a certain component means that the component may be further included, without excluding the other component unless specifically stated otherwise.

1 is a block diagram schematically illustrating an Ethernet-based stand-alone network security system according to a preferred embodiment of the present invention.

Referring to FIG. 1, the Ethernet-based stand-alone network security system 100 according to the present invention includes control processing means 200 for performing operation control and state management of the entire system, and the control processing means 200. Network processing means (300) for performing traffic management functions in conjunction with and outputting the resulting switching / routing path information to a corresponding line interface or monitor interface, or performing the reverse function, and a line interface connected to an external network; A monitor interface connected to an external network or the control processing terminal 200 to restore the line interface signal or the monitor interface signal to a physical layer signal, and then transfer the signal to the network processing means 300 or perform the reverse function. From the Ethernet physical layer means 400 and the control processing means 200 And storage means 500 for receiving and storing log information for the system monitor.

In addition, the Ethernet-based stand-alone network security system 100 supplies power to the control processing means 200, the network processing means 300, the Ethernet physical layer means 400 and the storage means 400, It further comprises a power supply and fan means 600 for performing a system internal temperature control function.

In FIG. 1, reference numerals 710 to 770 denote interfaces for connecting means, 710 is an EIA-232C debugging interface, 720 is a 10 / 100BASE-T based management interface, and 730 is a parallel component interconnect (PCI). 740 is a monitoring interface, 750 is a line interface connected to the external network, 760 is an interface connecting the network processing means 300 and the Ethernet physical layer means 400, 770 is an Enhanced Integrated Drive Electonics (E-IDE) interface 780 is a self loopback interface and 790 is a cross loopback interface.

The detailed structure and effect | action of each structural means are demonstrated below.

The power supply and fan means 600 is implemented as a hot-swappable redundant power supply to supply a stable power to the system, for the smooth operation of the respective means, the inflow of air Overheating and exhaust control the temperature inside the system.

The control processing means 200, the PCI device including the network processing means 300 via a PCI interface 730, the Ethernet physical layer means 400 through an External Slave peripheral Interface (ESPI) (not shown) Initialize and diagnose the ESPI device, including, and collects the state information and processes it according to a set procedure.

In addition, the control processing means 200 provides debugging to the console through the EIA-232C debugging interface 710, and also remotely upgrades the operating system or network files via the 10 / 100BASE-T Ethernet management interface 720. Provide a system development environment.

In addition, the control processing means 200 performs a function of processing a protocol related to switching, routing, and security by interworking with the network processing means 300 with respect to a packet received through the Ethernet physical layer means 400. Perform.

The control processing means 200 also stores log information in the storage means 500 via the E-IDE interface 770. The storage means 500 may be implemented as a hard disk.

 Next, the Ethernet physical layer means 400 includes a first unit Ethernet physical layer means 410 including a plurality of line interfaces 750 connected to an external network and a monitoring interface 741 connected to the control processing means 200. ), A second unit Ethernet physical layer means 420 including a plurality of line interfaces 750 connected to an external network and a monitoring interface 742 connected to an external server, and the network processing means 300 includes: The first and second unit Ethernet physical layer means 410 and 420 are connected to the first and second unit network processing means 310 and 320, respectively.

The network physical layer means 300 and the Ethernet physical layer means 400 will be described with reference to FIGS. 2 and 3.

2 is a detailed block diagram of the Ethernet physical layer means 400.

2, the first and second unit Ethernet physical layer means 410 and 420 are 100BASE-T physical layers 411 and 421, two 1000BASE-X physical layers 412 and 422, and 8 port 10 / 100BASE-T physical layers, respectively. (413,423).

The 1000BASE-T physical layers 411 and 421 restore the signals received through the 1000BASE-T based monitoring interfaces 741 and 742 to the physical layer signals through analog-to-digital conversion, adaptive equalization, clock / data extraction, and physical coding. It is configured as a TBI (Ten Bit Interface) interface 761 signal group and transmitted to the corresponding unit network processing means (310,320) or performs the reverse function.

In addition, the two 1000BASE-X physical layers 412 and 422 receive two ports of the 1.25Gbps 1000BSE-X line interface 751 signal from the external network through the optical fiber, and recover the physical layer signal through clock / data extraction and demultiplexing. Then, it is composed of the TBI interface 762 signal group of 62.5 MHz clock and 125 Mbps 10-bit data per port and forwarded to the corresponding unit network processing means (310,320) or performs the reverse function.

In addition, the 8-port 10 / 100BASE-T physical layer (413,423) receives analog-digital signals by receiving 8-port 10Mbps / 125Mbps 10 / 100BASE-T Ethernet line interface 752 signals from the external network through the unshielded twisted pair (UTP). After reconstruction to a physical layer signal through conversion, adaptive equalization, clock / data extraction, and physical coding, it is composed of a serial media independent interface (SMII) interface 763 signal group of 125Mbps 1-bit data signals per port. Transfer to processing means (310,320) or perform the reverse function.

By the first and second unit Ethernet physical layer means 410,420, at the second layer of the open system interconnect model for network security processing via a 1000BASE-T interface or a 1000BASE-X interface or a 10/100 BASE-T interface. The control and data information up to the seventh layer are transmitted to the first and second unit network processing means 310 and 320, and conversely, the processing result for the control and data information is received and output through the corresponding line interface.

In this case, the first and second unit network processing means 310 and 320 have a structure as shown in FIG. 3.

Referring to FIG. 3, the first and second unit network processing means 310 and 320 may include unit Ethernet physical layer means 410 and 420 through the TBI (Ten Bit Interface) interface 761 and 762 signal group and the SMII interface 763 signal group. Control and data information from the second layer to the seventh layer of the open system interconnect model, and through the PCI interface 730 having a 33 MHz clock and 32 bit data / address. It works.

More specifically, the first and second unit network processing means 310 and 320 respectively control and data received from the first and second unit Ethernet physical layer means 410 and 420 through interworking with the control processing means 200. Information classification features, including parsing, searching, modification, and queuing, and look-up, polishing, flow-by-flow queuing, and shaping Perform traffic management.

The information classification and traffic management result is composed of 4 Gbps Data-Aligned Synchronous Link (DASL) interface signal group and output through the loopback interface 780, 790 to the line interface corresponding to the destination port. Output to DASL self-loopback interface 780 if it is in connected unit Ethernet physical layer means, or to DASL cross loopback interface 790 connected to other unit network processing means if its destination port is not in unit Ethernet physical layer means connected thereto. do.

The first and second unit network processing units 310 and 320 and the control processing unit 200 may be implemented in the form of a daughter board.

As described above, the network security system according to the present invention supports a 1000 BASE-T physical layer, a 2-port 1000BASE-X physical layer, and an 8-port 10 / 100BASE-T physical layer to satisfy various requirements of a user. In particular, a network security system according to the present invention includes a 16-port 10 / 100BASE-T Ethernet line interface, a 4-port 1000BASE-X Gigabit Ethernet interface, and a 2-port 1000BSE-T Gigabit Ethernet network processor interface. Also, it supports 10 / 100BASE-T Ethernet management interface and EIA-232C interface for debugging, enabling users to implement security system as they want.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

1 is a block diagram showing a schematic structure of an Ethernet-based stand-alone network security system according to the present invention;

2 is a block diagram showing the detailed structure of the Ethernet physical layer means in the network security system according to the present invention;

3 is a block diagram showing the detailed structure of the network processing means in the network security system according to the present invention.

Claims (14)

Control processing means for performing operation control and state management of the entire system; Network processing means for performing a traffic management function in association with the control processing means and outputting the resulting switching / routing path information to a corresponding line interface or monitor interface or performing the reverse function; And a line interface connected to an external network, and a monitor interface connected to an external network or the control processing means to restore the line interface signal or the monitor interface signal to a physical layer signal and then transfer the reverse interface signal or the reverse function to the network processing means. Ethernet physical layer means for performing; And And storage means for receiving and storing log information for a system monitor from said control processing means. The method of claim 1, Ethernet-based stand-alone network security, characterized in that it further comprises a power supply and fan means for supplying power to the control processing means, network processing means, Ethernet physical layer means and storage means, and performs a system internal temperature control function. system. The method of claim 2, wherein the control processing means Initializes and diagnoses a PCI device including the network processing means through a parallel component interconnect (PCI) interface and an ESPI device including the Ethernet physical layer means through an external slave peripheral interface (ESPI) and collects state information. Ethernet-based stand-alone network security system, characterized in that the processing according to the procedure. The method of claim 2, wherein the control processing means An Ethernet-based stand-alone network security system further comprising the ability to remotely upgrade the operating system or provide a network file system development environment through a 10 / 100BASE-T Ethernet management interface. The method of claim 2, wherein the control processing means Ethernet-based stand-alone network security system, characterized in that it further comprises a function to provide debugging to the console via the EIA-232C debugging interface. The method of claim 2, wherein the control processing means Ethernet-based stand-alone network security system, characterized in that for storing log information in the storage means through an Enhanced Integrated Drive Electonics (E-IDE) interface. The method of claim 2, The Ethernet physical layer means may include a plurality of line interfaces connected to an external network, a first unit Ethernet physical layer means including a monitoring interface connected to the control processing means, a plurality of line interfaces connected to an external network, and an external server. And a second unit Ethernet physical layer means including a monitoring interface connected with the And said network processing means comprises first and second unit network processing means connected respectively to said first and second unit Ethernet physical layer means. 8. The method of claim 7, wherein the first and second unit Ethernet physical layer means are respectively After recovering the signal received through the 1000BASE-T monitoring interface to the physical layer signal, the 1000BASE-T physical layer is configured as a TBI (Ten Bit Interface) interface signal group and transmitted to the corresponding unit network processing means or performs the reverse function. ; It receives two ports of 1.25Gbps 1000BSE-X line interface signal from the external network and restores it to the physical layer signal, and then configures it as a TBI interface signal group and transmits it to the corresponding unit network processing means or performs the reverse function. Two 1000BASE-X physical layers; And Receives 10Mbps / 125Mbps 10 / 100BASE-T Ethernet line interface signal through the unshielded twisted pair cable (UTP) from the external network, restores it to the physical layer signal, and then configures it as a serial media independent interface (SMII) interface signal group. Ethernet-based stand-alone network security system comprising an 8-port 10 / 100BASE-T physical layer to pass to the network processing means or vice versa. The method of claim 8, In the first and second unit Ethernet physical layer means, a signal received through a 1000BASE-T monitoring interface or a 10 / 100BASE-T Ethernet line interface is a physical layer signal through analog-to-digital conversion, adaptive equalization, clock / data extraction, and physical coding. Ethernet-based stand-alone network security system, characterized in that restored to. The method of claim 8, In the first and second unit Ethernet physical layer means, the signal received through the 1000BASE-X line interface is restored to the physical layer signal through the clock / data extraction, demultiplexing, Ethernet-based stand-alone network security system. 8. The apparatus of claim 7, wherein the first and second unit network processing means are respectively Ethernet-based control and data information received from the second through seventh layer of the open system interconnect model from the corresponding unit Ethernet physical layer means through the Ten Bit Interface (TBI) interface signal group and the SMII signal group Stand-alone network security system. 8. The apparatus of claim 7, wherein the first and second unit network processing means are respectively Ethernet-based stand-alone network security system characterized by interworking with control processing means via a PCI interface. 12. The apparatus of claim 11, wherein the first and second unit network processing means are respectively Ethernet-based stand-alone characterized by performing information classification functions including analysis, investigation, correction, and queuing for the received control and data, and traffic management functions including lookup, polishing, flow-by-flow queuing, and shaping. Network security system. 14. The apparatus of claim 13, wherein the first and second unit network processing means are respectively After the information classification and traffic management execution result is composed of DASL (Data-Aligned Synchronous Link) interface signal group, if the destination port is in the unit Ethernet physical layer means connected to it, it is output to the DASL self loopback interface, and the destination port is Ethernet-based stand-alone network security system, characterized in that output to the DASL cross-loopback interface connected to other unit network processing means when not in the unit Ethernet physical layer means connected to it.

Images