A method for communicating between an inner network and an outer network based on a PCIE link of an FPGA

Abstract

The application discloses a kind of inner and outer network communication methods of PCIE link based on FPGA, comprising (1) inner network receives the communication request and configuration management information sent by external terminal and handles and forwards to inner network VPP passage node;(2) inner network VPP passage node according to protocol processing network topology, control management service and communication information and send to FPGA acceleration card with acceleration data by PCIE;(3) PCIE acceleration card based on FPGA receives and processes the communication data to be accelerated and sends to outer network VPP passage node;(4) outer network VPP passage node receives the communication data that has been accelerated and forwards to black area communication terminal.The application is in the background of red and black isolation, through PCIE high-speed equipment interconnect inner and outer network, combine the high-speed performance of VPP and DPDK, use virtual network interface TUN equipment and VETH equipment to simultaneously open the passage of inner and outer network system local, to guarantee the communication of red area and black area external terminal.In the high-speed performance of maintaining network transmission, realize the architecture communication of inner and outer network service plane and control plane.

Description

TECHNICAL FIELD

[0001] The present application belongs to the field of Internet information technology, and more particularly relates to a method for internal and external network communication based on a PCIE link of an FPGA (Field Programmable Gate Array). BACKGROUND

[0002] In recent years, with the rapid development of the Internet, information security problems brought by Internet information technology have become the focus of attention, and network identity authentication, data transmission encryption, password algorithm standards and protocols, and other information security technologies have gradually become rich. Among them, the requirement of red-black isolation ensures the isolation of devices in the red area and the black area, and guarantees the safe and reliable real-time information exchange between the internal and external networks. Under the background of red-black isolation, the internal and external networks usually use PCIE (peripheral component interconnect express) cryptographic cards to provide security services for the transmitted data information, and in order to meet the high-speed performance requirements of network transmission, higher requirements are put forward for the performance indicators of PCIE cryptographic cards, high-speed driving of devices, and the data transmission architecture environment of internal and external networks.

[0003] DPDK (Data Plane Development Kit) has a function library and a driver set for quickly processing packet data, which significantly improves the performance and throughput of network data transmission. DPDK uses polling instead of interruption to reduce CPU interruption time and memory copy frequency, bypasses the kernel protocol stack in the user state, and reduces complexity. VPP (Vector Packet Processing) is a high-performance network protocol stack, which can well reuse the data high-speed transmission characteristics of DPDK through extensive integration of plug-ins. When data information is transmitted in the red area and the black area system, the actual physical hardware device interface is taken over by the high-speed network card driver, and the network interface can be created through virtual network interface technology to provide TUN devices and VETH devices to guarantee the transmission of business, management, and configuration messages. SUMMARY

[0004] In view of the defects of the prior art, the purpose of the present application is to provide a method for internal and external network communication based on a PCIE link of an FPGA, which aims to solve the problem of affecting red-black area business communication and configuration management information transmission due to physical isolation of internal and external networks under the background of red-black isolation in the prior art.

[0005] The present application provides a method for internal and external network communication based on a PCIE link of an FPGA, comprising the following steps:

[0006] (1) The inner network receives the communication request and configuration management information sent by the external terminal and processes and forwards to the inner network VPP channel node;

[0007] (2) The inner network VPP channel node processes the network topology, control management business and communication information according to the protocol and sends the data with acceleration to the FPGA acceleration card through PCIE;

[0008] (3) The PCIE acceleration card based on FPGA receives and processes the communication data to be accelerated and sends to the outer network VPP channel node;

[0009] (4) The outer network VPP channel node receives the communication data with acceleration and forwards to the black area communication terminal.

[0010] Further, step (1) specifically includes:

[0011] (1.1) The inner network creates a TUN device in the Linux kernel to receive the communication management configuration information sent by the external terminal;

[0012] (1.2) The inner network creates a virtual network interface in the Linux kernel, VETH0 / VETH1 PAIR device, wherein VETH0 is used to receive the communication information processed and forwarded by the inner network TUN device, and VETH1 is used to be taken over by VPP to receive the communication information from VETH0 in the form of a host interface.

[0013] Further, step (2) specifically includes:

[0014] (2.1) The inner network VPP channel node receives the communication information transmitted by VETH1;

[0015] (2.2) The inner network VPP channel node processes the business, communication and configuration data information according to the protocol, and screens out the communication request that needs to be sent to the outer network;

[0016] (2.3) The inner network VPP channel node gives the communication request that needs to be sent to the outer network to the XDMA high-speed device driver for processing, and sends it to the PCIE acceleration device through the PCIE link channel.

[0017] Further, step (3) specifically includes:

[0018] (3.1) The acceleration card sends the communication data to be accelerated to the acceleration core after data packet preprocessing;

[0019] (3.2) The acceleration core processes the data packet according to the protocol format of the inner and outer network nodes after completing data acceleration, and sends the communication data with acceleration to the outer network VPP channel node.

[0020] Among them, the data packet preprocessing includes protocol processing, reassembly of fragmented packets and data sequence preservation.

[0021] Further, step (4) specifically comprises:

[0022] (4.1) The outer network VPP node receives the accelerated communication data through the XDMA driver;

[0023] (4.2) The outer network VPP node processes the accelerated communication data according to the protocol control, and simultaneously sends the data to the VETH1 device on the basis of having a TUN device and a VETH0 / VETH1 PAIR device;

[0024] (4.3) The outer network VETH0 device receives the communication data transmitted by the VETH1, processes and forwards the communication data to the outer network TUN device, and then transmits the communication data to the external terminal.

[0025] Wherein, the TUN devices on the inner network and the outer network are configured in the same network segment. A proxy program is set between the TUN device and the VETH0 device, and the communication request received by the TUN device is analyzed and processed according to the forwarding strategy for different message types. The communication request obtained by the VETH1 device is captured in the hostinterface of the VPP platform by using the point-to-point transmission characteristics of the VETH PAIR device, and then processed according to the forwarding strategy, and the data information is sent to the PCIE acceleration card through the XDMA acceleration card high-speed driver encapsulation processing. The double PCIE acceleration cards connected with the inner network and the outer network respectively accelerate the data to be communicated between the inner network and the outer network through the PCIE link.

[0026] Compared with the prior art, the above technical scheme conceived by the present application provides a communication method of the inner network and the outer network by connecting the inner network and the outer network through the PCIE high-speed device in the context of red-black isolation; the virtual network interface TUN device and the VETH device are used to simultaneously open the channel of the inner network and the outer network system locally to guarantee the communication of the external terminals in the red area and the black area, in combination with the high-speed performance of the VPP and the DPDK. While maintaining the high-speed performance of the network transmission, the information transmission channel is established, the protocol analysis and processing are performed, and the architecture communication of the inner network and the outer network service plane and the control plane is realized. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1 is the implementation flowchart of the inner and outer network communication method based on the PCIE link of the FPGA provided by the embodiment of the present application;

[0028] Figure 2 is the composition schematic diagram of the inner and outer network communication architecture based on the PCIE link of the FPGA provided by the embodiment of the present application;

[0029] Figure 3 is the implementation flowchart schematic diagram of the inner and outer network communication method based on the PCIE link of the FPGA provided by the embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0031] The present invention relates to a method for internal and external network communication under red-black isolation, and particularly relates to an FPGA-based PCIE device as a physical connecting component of the internal and external network, and is suitable for internal and external network communication under the requirements of secure hardware isolation.

[0032] like Figure 1 As shown, an embodiment of the present invention provides an intranet and extranet communication method based on an FPGA-based PCIE link in a red-black isolation context, including the intranet receiving communication requests and configuration management information sent by the red zone, processing and forwarding them to the intranet VPP channel node; the intranet VPP channel node processes the network topology and control management services and communication information according to the protocol and sends accelerated data to the FPGA accelerator card via PCIE; the FPGA-based PCIE accelerator card receives and processes the communication data to be accelerated and then sends it to the extranet VPP channel node; the extranet VPP channel node receives the accelerated communication data and controls and forwards it to the black zone communication terminal, specifically including:

[0033] (1) The intranet receives the communication request and configuration management information sent by the external terminal and processes and forwards it to the intranet VPP channel node, including the following sub-steps:

[0034] (1.1) The intranet creates a TUN device in the Linux kernel (or other UNIX-like systems) to receive communication management configuration information sent by external terminals.

[0035] (1.2) Create a virtual network interface pair VETH0 / VETH1 in the Linux kernel on the intranet. VETH0 is used to receive communication information processed and forwarded by the intranet TUN device, and VETH1 is taken over by VPP and receives communication information from VETH0 in the form of a host interface.

[0036] (2) The intranet VPP channel node processes the network topology and control management services and communication information according to the protocol and sends accelerated data to the FPGA accelerator card via PCIE:

[0037] (2.1) The intranet VPP channel node receives the communication information transparently transmitted by VETH1.

[0038] (2.2) The intranet VPP channel node processes business, communication, and configuration data information according to the protocol and selects the communication requests that need to be sent to the external network.

[0039] (2.3) The internal network VPP channel node hands over the communication request to be sent to the external network to the XDMA high-speed device driver for processing, and sends it to the PCIE acceleration device through the PCIE link channel.

[0040] (3) The PCIE acceleration card based on the FPGA receives and processes the communication data to be accelerated and sends it to the external network VPP channel node:

[0041] (3.1) After the acceleration card receives the communication data to be accelerated, it can perform protocol processing, packet reassembly, data sequence preservation, and other data packet preprocessing before sending it to the acceleration core.

[0042] (3.2) After the acceleration core completes data acceleration, it processes the accelerated communication data according to the protocol format of the internal and external network nodes and sends it to the external network VPP channel node.

[0043] (4) The external network VPP channel node receives the accelerated communication data and controls forwarding to the black area communication terminal:

[0044] (4.1) The external network VPP node receives the accelerated communication data through the XDMA driver.

[0045] (4.2) The external network VPP node processes the accelerated communication data according to the protocol control, and simultaneously sends the data to the VETH1 device based on the TUN device and VETH0 / VETH1 PAIR device.

[0046] (4.3) The external network VETH0 device receives the communication data transmitted by VETH1 and forwards it to the external network TUN device, and then to the external terminal.

[0047] The application is further described as follows in combination with the accompanying drawings:

[0048] The application is applicable to the red-black isolation background, and realizes the communication of business and management data between the internal and external networks through the PCIE device, such as an acceleration card. In the embodiment of the application, the network topology is as shown in Figure 2 The internal and external network systems both deploy TUN devices and VETH PAIR devices, and simultaneously use VPP network protocol stacks to perform high-speed transmission of data packets through DPDK, thereby guaranteeing the functional and performance requirements of the business plane and the management plane.

[0049] The specific transmission process of the communication request is as shown in Figure 3

[0050] The TUN devices on the internal and external networks can be configured in the same network segment (192.168.1.1 / 192.168.1.2) and exposed to external terminals connected on both sides to receive, send, filter, and process communication requests.​

[0051] The proxy is set between the TUN device and the VETH0 device, and analyzes and processes different message types according to a forwarding policy for a communication request received by the TUN device. For a communication request that needs to be executed locally, relevant processing is directly executed, and for a communication request that needs to be transmitted to the opposite end, the communication request is transmitted to the VETH0 device for forwarding.

[0052] By using the point-to-point transmission characteristics of the VETH PAIR device, the communication request obtained by the VETH1 device is captured in the host interface of the VPP platform, and then processed according to the forwarding policy, and data information is transmitted to the PCIE acceleration card through the XDMA acceleration card high-speed drive encapsulation processing.

[0053] The two PCIE acceleration cards connected to the internal and external networks respectively accelerate the data to be communicated between the internal and external networks through the PCIE link. The communication data is transmitted from the protocol processing CPU control module to the service processing FPGA algorithm core, and then transmitted to the CPU control module after service processing, and then transmitted to the opposite end.

[0054] After the data is transmitted from the internal network to the external network, the data flow is essentially the reverse operation on the internal network, and does not need to be described.

[0055] Those skilled in the art will readily understand that the above description is only a preferred embodiment of the present application, and is not intended to limit the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for communicating between an inner network and an outer network based on a PCIE link of an FPGA, characterized in that, The method comprises the following steps: (1) The TUN device deployed on the inner network receives the communication request and configuration management information sent by the external terminal, processes and forwards the information to the inner network VPP channel node through the VETH device; (2) The inner network VPP channel node processes the network topology, control management business and communication information according to the protocol and sends the to-be-accelerated data to the FPGA acceleration card through PCIE; (3) The FPGA acceleration card receives and processes the to-be-accelerated communication data and sends the data to the outer network VPP channel node; (4) The outer network VPP channel node receives the accelerated communication data, processes the data through the VETH device and forwards the data to the outer network TUN device, and then transmits the data to the external black area communication terminal; Step (1) specifically comprises: (1.1) The inner network creates a TUN device in the Linux kernel to receive the communication management configuration information sent by the external terminal; (1.2) The inner network creates a virtual network interface VETH0 / VETH1 PAIR device in the Linux kernel, wherein the VETH0 is used to receive the communication information processed and forwarded by the inner network TUN device, and the VETH1 is used to receive the communication information transmitted by the VETH0 in the form of a host interface.

2. The Intranet / Internet communication method of claim 1, wherein, Step (2) specifically comprises: (2.1) The inner network VPP channel node receives the communication information transmitted by the VETH1; (2.2) The inner network VPP channel node processes the business, communication and configuration data information according to the protocol and filters out the communication request to be sent to the outer network; (2.3) The inner network VPP channel node sends the communication request to be sent to the outer network to the XDMA high-speed device driver for processing and sends the request to the PCIE acceleration device through the PCIE link channel.

3. The method of communicating between the inner and outer networks of any of claims 1-2, wherein, Step (3) specifically comprises: (3.1) The acceleration card sends the to-be-accelerated communication data to the acceleration core after performing data packet preprocessing; (3.2) The acceleration core processes the accelerated communication data according to the protocol format of the inner and outer network nodes after completing data acceleration and sends the data to the outer network VPP channel node.

4. The Intranet / Internet communication method of claim 3, wherein, The data packet preprocessing comprises protocol processing, recombination of fragmented packets and data sequence preservation.

5. The method of communicating between the inner and outer networks of any of claims 1-2, wherein, Step (4) specifically comprises: (4.1) The outer network VPP node receives the accelerated communication data through the XDMA driver; (4.2) The outer network VPP node processes the accelerated communication data according to the protocol and sends the data to the VETH1 device based on the TUN device and the VETH0 / VETH1 PAIR device; (4.3) The outer network VETH0 device receives the communication data transmitted by the VETH1 and forwards the data to the outer network TUN device, and then transmits the data to the external terminal.

6. The Intranet / Internet communication method of claim 5, wherein, The TUN devices on the inner network and the outer network are configured in the same network segment.

7. The Intranet / Internet communication method of claim 1, wherein A proxy program is arranged between the TUN device and the VETH0 device, and the communication request received by the TUN device is analyzed and processed according to the forwarding strategy.

8. The intranet and extranet communication method according to claim 1, wherein: The VETH PAIR device point-to-point transmission characteristics are used, the communication request obtained by the VETH1 device is captured in the host interface of the VPP platform, and then the communication request is processed according to a forwarding strategy, and the data information is sent to the FPGA acceleration card through the XDMA acceleration card high-speed drive encapsulation processing.

9. The Intranet / Internet communication method of claim 1, wherein The double FPGA acceleration cards connected with the internal network and the external network respectively perform acceleration processing on the data needing communication in the internal network and the external network through the PCIE link.

Images