A real-time information detection network exchange system

Abstract

The present invention provides a real-time information detection network switching system, including an information detection network switching device, the information detection network switching device including a CPU processor, a switching chip, a reset system, a power supply, a clock, a hot-swap system and a management system; a network interface is provided at the front end of the switching chip, and the information detection network switching device is arranged at a core layer or an access layer; it also includes an information detection module connected between the CPU processor and the switching chip, the information detection module is connected to the switching chip through at least two 10 Gigabit Ethernet interfaces, and during the network switching process, the switching chip forwards the message of the required interface to the information detection module through a virtual routing forwarding protocol, and the information detection module detects, filters and alarms according to set rules. The present invention is suitable for scenes with high security requirements, and is deployed in the core layer or access layer of a network that communicates with an external network or connects to the Internet, monitors internal and external network communications, and prevents the internal network from being attacked or monitored by the external network.

Description

Technical Field

[0001] The present invention relates to the technical field of information network exchange, and in particular to a network exchange system capable of real-time information detection. Background Art

[0002] my country is currently and will continue to face a period of high national security risk. The risk of the enemy having already penetrated or is already on the network is real. Advanced persistent penetration attacks, in particular, against critical infrastructure such as finance, electricity, telecommunications, and energy, pose a significant threat to national security.

[0003] At present, network security construction mostly adopts firewall technology, which has the following defects in actual use:

[0004] Disadvantage 1: Traditional firewalls are deployed only at the core layer of the network and cannot protect against threats introduced by single users through storage media or wireless communications, which could pose a security threat to other users on the LAN.

[0005] Defect 2: The LAN cannot effectively protect the network security of specific users in the event of an enemy entering or already on the network.

[0006] Defect 3: Traditional firewalls are connected in series between the network core layer and the external network. In this way, if the firewall device itself fails, the external communication function of all users will be affected, which requires very high network reliability.

[0007] Defect 4: Traditional firewalls are connected in series between the network core layer and the external network. When a threat is detected, they can only block the access between the internal and external networks, denying all internal users' external communications, affecting overall work efficiency.

[0008] Defect 5: Traditional firewall equipment is large in size and power consumption. If each LAN is equipped with one, it will be less economical and practical, and will impose a certain burden on the overall system network planning. Summary of the Invention

[0009] In response to the above technical problems, the present invention provides a real-time information detection network switching system, which is suitable for scenarios with high security requirements. It is deployed in the core layer or access layer of the network for external network communication or connection to the Internet to monitor internal and external network communications and prevent the internal network from being attacked or monitored by the external network.

[0010] The technical solution of the present invention is: a real-time information detection network switching system, including an information detection network switching device, the information detection network switching device including a CPU processor, a switching chip, a reset system, a power supply, a clock, a hot-swap system and a management system; a network interface is provided at the front end of the switching chip, and the information detection network switching device is arranged in a core layer or an access layer;

[0011] It also includes an information detection module connected between the CPU processor and the switching chip,

[0012] The information detection module is connected to the switching chip via at least two 10 Gigabit Ethernet interfaces. During the network exchange process, the switching chip forwards the required interface messages to the information detection module via a virtual routing forwarding protocol. The information detection module performs detection, filtering, and alarming according to the set rules.

[0013] The information detection module is connected to the CPU processor through PCI-E and a Gigabit Ethernet interface. When the information detection module detects a threat data message, it alerts the CPU processor through the PCI-E and the Gigabit Ethernet interface. After receiving the alert information, the CPU processor controls the switching chip and the information detection module to block the threat data message.

[0014] Preferably, the information detection module includes an FPGA chip, a storage chip, a DDR3 memory, an RS232 conversion chip, a reset chip and a connector.

[0015] The FPGA chip is connected to the storage chip via an SPI interface and is also connected to the DDR3 memory via a DDR3 interface;

[0016] The FPGA chip is connected to the CPU processor via PCIE, and is also connected to the switching chip via two 10 Gigabit Ethernet interfaces.

[0017] Further preferably, the information detection module divides data processing into a data channel and a control channel, the data channel is responsible for storing and forwarding data, and the control channel is responsible for function processing and notifying the data channel of instructions through forwarding information;

[0018] The data channel mainly includes input / output interface module, input / output segmented storage, input / output read and write arbitration, read and write data cache, cache management, queue scheduling management modules, interrupt controller, and CPU control channel. In order to reduce the load of the CPU, a high-speed PCIE interface and DMA controller are integrated.

[0019] Further preferably, information detection software is stored in the FPGA chip, and the information detection software has the function of resisting server attacks and supports binding of MAC and IP;

[0020] The information detection software also has network access control functions: the primary rule supports 12 tuples, and the secondary rule supports 4 custom fields; it allows different access rules for flows with specified source ports and destination ports; it supports passing and discarding, forwarding to the processor, and realizing combined rules of software and hardware collaboration.

[0021] Further preferably, the information detection software also supports mainstream denial of service attack protection and flooding attack; supports resistance to source routing attack, land_attack attack, ping_of_death attack, and winnuke attack; supports access control of special-shaped messages, supports management of unknown layer 2 messages, unknown layer 3 messages, too long ICMP messages, too short fragment messages, illegal IP, UDP checksum error messages; supports TCP / IP protocol family risk message inspection and protection, supports TCP SYN fragment message, TCP FIN fragment message, TCPRST fragment message management, supports IP option check, TCP flag check, layer 3 security check and layer 4 security check.

[0022] Preferably, the setting rule of the information detection module is: to prevent special messages from the external network during a specific period by monitoring the data message characteristics in the network system.

[0023] Further preferably, the monitoring of data message features in the network system includes message information filtering processing: providing matching rules based on Layer 2-5 data message features, allowing users to set filtering rules based on message information fields.

[0024] Preferably, a network configuration is provided in the switching chip to realize the control of whether external data needs to be detected for external data of different ports;

[0025] Specifically:

[0026] Terminal A and terminal B's external communication needs to be sent to the information detection module.

[0027] Or terminal C does not need to send information to the information detection module for external communication, and directly forwards it on the information access switching chip.

[0028] The beneficial effects of the present invention are:

[0029] The real-time information detection network switching system can be deployed at either the core or access layer, with functionality split according to individual user needs. For example, the core layer only needs to detect external attacks, while the access layer only needs to detect internal threats. Furthermore, the information detection network switching device of the present invention innovatively incorporates an information detection module, enabling targeted data information detection while the system is "downstream."

[0030] The present invention fully meets the following needs:

[0031] First, low latency: Using FPGA chip design, the message is parsed and stored once, and multiple hardware modules independently look up tables, ensuring that the delay is relatively fixed and less than 100us;

[0032] Second, high bandwidth: Using 10 Gigabit Ethernet interface communication, line-speed forwarding can be achieved even when all access control rules are configured, avoiding the disadvantage of traditional devices where the more rules there are, the lower the forwarding bandwidth.

[0033] Third, high reliability: The information detection module works independently of the switching system. On the one hand, the device itself is not affected by network message attacks; on the other hand, even if the information detection module fails, it will not affect the hardware's message forwarding processing.

[0034] Fourth, low power consumption: FPGA chip implementation has lower power consumption than multi-core processors. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 This is a working scenario diagram of network switching equipment.

[0036] Figure 2 This is a block diagram of the hardware principle of the network switching device of the present invention.

[0037] Figure 3 This is the logic diagram of data flow forwarding of information detection network switching equipment.

[0038] Figure 4 This is the hardware principle block diagram of the information detection module.

[0039] Figure 5 This is the internal processing flow chart of the information detection module.

[0040] Figure 6 This is the logic diagram of the information detection module processing.

[0041] Figure 7 It is the internal network design diagram of the information detection network switching equipment. DETAILED DESCRIPTION

[0042] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0043] See also Figures 1 to 7 This embodiment provides a real-time information detection network switching system, including information detection network switching equipment, see Figure 2 ,Information detection network switching equipment includes CPU processor, switching chip, reset system, power supply, clock, hot plug system and management system;

[0044] CPU processor functions: Control and manage peripheral devices such as switching chips and information detection modules, maintain protocol messages of the switching system, and send alarm information to superiors;

[0045] Function of the switching chip: Mainly realizes the switching and forwarding of Ethernet data packets and realizes the configuration, management and status monitoring of external interfaces;

[0046] Reset system function: The internal watchdog circuit can reset all devices on the board. When the system CPU hangs, the GPIO from the CPU will not jump regularly. The SM706 will not detect the signal change of WDI and will send WDO. WDO will trigger the RESET signal, thus completing the reset of the entire system.

[0047] Function of the power supply system: The external power supply voltage of the device is AC 220V, which is converted into DC 12V power required by the mainboard through the internal AC / DC power supply of the device, and then converted into various power supply voltages required by all systems through the DC / DC power supply;

[0048] The main function of the clock system is to use a high-precision crystal oscillator as the clock generator for the entire board, and a temperature-compensated crystal oscillator or a recovered clock as the clock source. The various crystal oscillators are then used to provide the required frequency clocks for all devices (;

[0049] Hot-swap system function: The hot-swap circuit can realize the over-current protection, short-circuit protection and hot-swap function of the board;

[0050] Management system functions: monitors the internal temperature, main circuit voltage, power-on control, and other status information of the device. Through the management circuit, it adjusts the fan speed to control the internal temperature of the device according to the internal temperature of the device, thereby achieving efficient heat dissipation of the entire device.

[0051] In this embodiment, the CPU adopts the domestic Loongson 2K1000 processor, the switching chip adopts the domestic Shengke CTC7132 switching chip, the reset chip adopts the Guowei Electronics SM706 chip, the power chip adopts the Guowei Electronics SM4644 power chip, the clock system adopts the domestic Chenjing GJA144-25-C20-B4-D5-D and other crystal oscillators, the hot-swap chip adopts the domestic Jewatt JW7222 chip, and the management chip adopts the domestic China Electronics 58 Institute CS32F103CB chip. The connection methods and working principles between the various components are all existing technologies, so they will not be repeated here.

[0052] There is a network interface at the front end of the switch chip, see Figure 1 ,Information detection network switching equipment is set up in the core layer (i.e., the data center of the entire unit) or the access layer (i.e., the network access port of each subordinate department);

[0053] It also includes an information detection module connected between the CPU processor and the switching chip.

[0054] See also Figure 3 The information detection module is connected to the switching chip through at least two 10 Gigabit Ethernet interfaces. During the data packet exchange process in the network, the switching chip forwards the packets of the required interfaces to the information detection module through the virtual routing forwarding protocol. The information detection module is connected to the CPU processor through PCI-E and one Gigabit Ethernet interface. When the information detection module finds a threatening data packet, it sends an alarm to the CPU processor through PCI-E and one Gigabit Ethernet interface. After receiving the alarm information, the CPU processor controls the switching chip and the information detection module to block the threatening data packet. This prevents the threatening data packet from being sent out and has no impact on other networks. The information detection module detects, filters and alarms according to the set rules;

[0055] See also Figure 4 In this embodiment, the information detection module includes an FPGA chip, a storage chip, a DDR3 memory, an RS232 conversion chip, a reset chip, and a connector. In this embodiment, the FPGA chip adopts the domestically produced JFM7VX690T20-AS chip of Fudan Micro.

[0056] The FPGA chip is connected to the memory chip through the SPI interface, mainly for the FPGA software to read and write from the FLASH. It is also connected to the DDR3 memory through the DDR3 interface to display the current working status of the FPGA software.

[0057] The FPGA chip is connected to the CPU processor through the PCIE interface and is also connected to the switch chip through two 10 Gigabit Ethernet interfaces.

[0058] In this embodiment, the setting rule of the information detection module is: to prevent special messages from the external network during a specific period by monitoring the characteristics of data messages in the network system.

[0059] The data message characteristics of the monitoring network system include message information filtering processing: providing matching rules based on Layer 2 to 5 data message characteristics, allowing users to set filtering rules based on message information fields.

[0060] The information detection function implementation mechanism includes:

[0061] (1) Layer 2 parsing and rate control

[0062] Layer 2 protocol parsing and rate control process: When a data packet enters the control channel, it first undergoes Layer 2 protocol parsing to determine whether the original packet is VLAN-tagged. The 4-byte type-length field after the VLAN tag and the subsequent bytes are used to determine the packet type, such as Ethernet II packet, SNAP packet, 802.3raw packet, or LLC frame. Based on the packet type, the corresponding packet information is extracted and a validity check is performed. Only data that passes the validity check is allowed to enter the next process for inspection; otherwise, it is discarded. Layer 2 protocol parsing focuses on the packet's source and destination MAC address, VLAN ID, type-length, CRC, and Layer 2 protocol type.

[0063] (2) Three-layer parsing and legality check

[0064] Layer 3 parsing process: First, determine whether it is an IPv4 packet (protocol type 0x0800). If it is an IPv4 message, determine the length of the IP header. If it is less than 20 bytes, it is counted as an abnormal error message. If it is greater than 20 bytes, it means there are IP options. For messages greater than or equal to 20 bytes, extract the 20-byte IP header and make a judgment. The three layers need to process the source and destination IP / IP type / IP length / fragment message / fragment length and position / TTL lifetime / IP header checksum, etc. Through layer 3 parsing, you can determine whether the message is layer 3 unicast / multicast / subnet broadcast, etc.

[0065] (3) IP option processing flow

[0066] IP option processing: This supplements the Layer 3 protocol parsing process. When the IP packet header is larger than 20 bytes, the packet header is split and parsed, and the parsed option type is recorded. Option checking is also enabled, and packets with incorrect options are discarded.

[0067] (4) Four-layer parsing and legality check

[0068] Layer 4 parsing and validity checking process: During Layer 3 protocol parsing and validity checking, the IP protocol is obtained from the IP packet header. Layer 4 protocols include UDP, TCP, ICMP, and IGMP, four common network protocols. Separate validation methods are applied to each of the four protocols, with corresponding validation options. Only data that meets the validation criteria is passed; otherwise, data is discarded.

[0069] (5) ICMP parsing and legitimacy check

[0070] ICMP parsing and legitimacy check process: The protocol parsing L3 parsing module obtains data packets with ICMP protocol, extracts the ICMP code, type and checksum, converts the ICMP type, extracts the ICMP ID number and sequence number, and extracts the IP header and 8 bytes of IP data. Then, the legitimacy of the ICMP protocol is checked through options such as ICMP type filter, legitimacy check, and checksum check. Only packets that meet the inspection specifications are passed, otherwise they are discarded.

[0071] (6) TCP option check

[0072] TCP option check process: When the TCP header length exceeds 20 bytes, it indicates the presence of a TCP option. The system extracts the TCP option content and matches and judges it against the option content defined by the protocol to determine whether there are any errors or anomalies, and then determines the corresponding forwarding behavior.

[0073] (7) HTTP content parsing

[0074] HTTP content parsing process: If the destination port is TCP 80 or the port is not 80 but the content header contains the keyword "http", it can be determined to be an HTTP message. For HTTP messages, the HTTP content contained in the message will be further analyzed to identify the HTTP protocol (such as get / put / upload) and HTTP content (such as attachment type / file name / application layer protocol).

[0075] (8) Protocol parsing filter table processing flow

[0076] Protocol parsing filter table processing flow: The protocol parsing filter table processing flow shows the complete protocol parsing process of the message, starting from the second-layer header of the message to the message content layer, and judging based on the content of each layer of parsing and the corresponding system settings to determine whether a match or filtering is performed at that layer. The various actions in the above figure are the behaviors after matching.

[0077] (9) Matching behavior process

[0078] Matching behavior process: A decision is made based on the matching results to determine the final forwarding behavior of the packet. Security zones can be set based on VLANs and physical interfaces, and matching levels can be set within these zones to determine whether to filter, discard, or send the packet to the processor for further analysis. If there are multiple matching results, the priorities set in the matching result tables are used for judgment, and the forwarding result with the highest priority is selected as the final forwarding behavior of the protocol parsing.

[0079] In this embodiment, the information detection module divides data processing into a data channel and a control channel. The data channel is responsible for storing and forwarding data, and the control channel is responsible for function processing and notifying the data channel of instructions through forwarding information.

[0080] The data channel mainly includes input / output interface module, input / output segmented storage, input / output read and write arbitration, read and write data cache, cache management, queue scheduling management modules, interrupt controller, and CPU control channel. In order to reduce the load of the CPU, a high-speed PCIE interface and DMA controller are integrated.

[0081] See also Figure 5 ,in:

[0082] Input and output interface modules: MAC / XGMAC / XAUI / SGMII, etc. For CPU interface, it is PCIE channel;

[0083] Input / output segmented storage module: segmented data cache is implemented using internal SRAM and control logic;

[0084] Input / data read / write arbitration module: used for input / output arbitration, implemented using the internal memory controller or DDR controller and design control logic;

[0085] Read and write data cache module: internal storage or external DDR memory, etc.;

[0086] Cache management module: used for multiple data frame cache and scheduling management modules;

[0087] Queue scheduling management module: used to implement QOS / queue entry / exit management, etc.;

[0088] DMA controller: The CPU's transceiver channels perform high-speed data maintenance. Currently, the design has four transceiver channels and four transmit and receive channels, supporting messages / telegrams, etc.

[0089] Interrupt controller: It provides fast data / information access response through interrupt mode and CPU. The default mode is MSI, which will be compatible with MSI-X mode in the future.

[0090] The control channel mainly includes protocol analysis module, first-level information filtering module, second-level information filtering module, policy control and rule search module, bandwidth statistics and service control module, control channel output information summary module, message management module, etc.

[0091] Among them, see Figure 6 The protocol parsing module is the most important module of the control channel. As the entrance of the system control channel, it receives the message header information provided by the data channel and completes the following functions:

[0092] 1) Parsing the message: Parsing the message Layer 2 to 5 information fields and performing message legitimacy checks;

[0093] 2) Layer 2 related protocol processing;

[0094] 3) Message information filtering: Provides match rules based on Layer 2 to Layer 5 information fields, allowing users to set filtering rules based on message information fields;

[0095] 4) Provide rate limits for special packet types: L2 reserve multicast, L3 reserve multicast, ip first fragments, ip fragments.

[0096] 5) Provide statistics based on MATCH rules and message PARSE;

[0097] See also Figure 6 The protocol parsing module extracts the synchronized frame header information and performs some of the processing described below:

[0098] a) Frame header analysis

[0099] Parse the frame header information from Layer 2 to Layer 5 and extract the information fields of each layer:

[0100] 1) Layer 2: Identify and parse Layer 2 encapsulations of Ether II, 802.3 SNAP, 802.3 LLC, and 802.3 RAW over IPX.

[0101] 2) Layer 2: Identify and parse ARP, RARP, ICMP, IGMP, and IP packets;

[0102] 3) Layer 3: Identify and parse IPv4 and non-IPv4 packets;

[0103] 4) Layer 4: Identify and parse TCP and UDP packets;

[0104] 5) Layer 5: Identify and parse HTTP GET and HTTP PUT messages;

[0105] After the protocol analysis module identifies various message types, it will perform corresponding message legitimacy checks based on the protocol definitions of different messages and discard messages that fail the legitimacy check according to the settings.

[0106] b) VLAN processing

[0107] The protocol parsing module performs the following related processing based on the extracted VLAN and source port information:

[0108] 1) VLAN protocol processing;

[0109] 2) Obtain the attributes of the virtual port to which the message belongs;

[0110] 3) Obtain the attributes of the security zone to which the message belongs;

[0111] c) Protocol filtering

[0112] The protocol parsing module provides protocol filtering for the parsed information fields of LAYER 2 to 5, including:

[0113] 1) DMAC-based protocol filtering;

[0114] 2) Ether TYPE-based protocol filtering;

[0115] 3) Protocol filtering based on DIP / SIP;

[0116] 4) Protocol filtering based on IP PORTOCOL field;

[0117] 5) Protocol filtering based on IP / TCP OPTION fields;

[0118] 6) Protocol filtering based on TCP FLAG field;

[0119] 7) Protocol filtering based on L4 destination port number + source port number;

[0120] 8) Protocol filtering based on the type field of ICMP messages;

[0121] 9) Protocol filtering based on the type field of IGMP messages;

[0122] 10) Filtering based on the type field of fragmented messages;

[0123] 11) Protocol filtering based on HTTP GET / PUT messages;

[0124] For the results of each protocol filtering, the final protocol filtering processing result is obtained according to certain rules.

[0125] d) Content filtering

[0126] The protocol parsing module provides content filtering for the parsed LAYER 5 information domain.

[0127] In this embodiment, information detection software is stored in the FPGA chip, and the information detection software has the function of resisting server attacks; supports MAC and IP binding; supports mainstream denial of service attack protection, and defends against various flooding attacks such as fragment flooding, UDP flooding, TCPSYN flooding, ICMP flooding, etc.; supports resistance to source routing attacks, land_attack attacks, ping_of_death attacks, and winnuke attacks; supports access control of special-shaped messages, supports management of unknown layer 2 messages, unknown layer 3 messages, overlong ICMP messages, too short fragment messages, illegal IPs, and UDP checksum error messages; supports TCP / IP protocol family risk message inspection and protection, supports TCP SYN fragment message, TCP FIN fragment message, TCPRST fragment message management, supports IPoption inspection, TCP flag inspection, layer 3 security inspection, and layer 4 security inspection;

[0128] The information detection software also has network access control functions: the primary rule supports 12 tuples, and the secondary rule supports 4 custom fields; it allows different access rules for flows with specified source ports and destination ports; it supports passing and discarding, forwarding to the processor, and realizing combined rules of software and hardware collaboration.

[0129] In this embodiment, see Figures 6 to 7 , there is a network configuration in the switching chip, the internal network configuration is as follows,

[0130] ip access-list fpga / / Create an access-list to match the messages that need to be sent to the FPGA

[0131] 10 permit any anyany

[0132] !

[0133] route-map fpga permit 10 / / Create policy routing

[0134] match ip address fpga / / Associate the policy routing with the access-list fpga

[0135] set ip next-hop 10.10.10.2 / / Set the next hop of the policy routing to FPGA

[0136] !

[0137] interface eth-0-1

[0138] noswitchport

[0139] ip address 192.168.10.254 / 24

[0140] ip policy route-map fpga / / Apply policy routing to eth-0-1 port

[0141] !

[0142] interface eth-0-2

[0143] noswitchport

[0144] ip address 192.168.11.254 / 24

[0145] ip policy route-map fpga

[0146] !

[0147] interface eth-0-3

[0148] noswitchport

[0149] ip address 192.168.12.254 / 24

[0150] !

[0151] interface eth-0-49

[0152] noswitchport

[0153] ip address 10.10.10.1 / 24

[0154] !

[0155] interface eth-0-50

[0156] noswitchport

[0157] ip address 10.10.20.1 / 24

[0158] !

[0159] ip route 0.0.0.0 / 0 20.20.20.20 / / The default route points to the external network, and 20.20.20.20 is the next hop IP to the external network

[0160] Internal information forwarding process:

[0161] S1: The destination MAC address of the terminal device accessing the external network will be filled with the device's route-mac (gateway MAC address) and sent to the switch.

[0162] S2: The module receives a message with a destination MAC address of route-mac and determines that routing is required.

[0163] S3: The module checks whether the port that receives the message is configured with policy routing. If so, it will prioritize matching the policy routing.

[0164] S4: The next hop of the policy routing is set to the IP address of the FPGA. The module sends the traffic accessing the external network from eth-0-49 to the FPGA through the policy routing.

[0165] S5: After cleaning the traffic, the FPGA uses its default route to point to the switch's 10.10.20.1 / 24 and sends the cleaned traffic back to the switch's eth-0-50. At this point, the destination MAC address of the packet after passing through the FPGA's default route is restored to the module's route-mac.

[0166] S6: After receiving the cleaned message from eth-0-50, the module finds that the destination MAC is the exchanged route-mac, and a route needs to be taken. Since port 5 is not configured with policy routing, the module matches the default route and sends the cleaned message to the external network.

[0167] In this embodiment, it is also possible to control whether external data needs to be detected for external data of different ports; specifically:

[0168] Terminal A and terminal B's external communication needs to be sent to the information detection module.

[0169] Or terminal C does not need to send detection information to the detection module for external communication, and the information is directly forwarded on the information access switching chip.

[0170] Since different devices have different application scenarios, the purpose of this setting is to treat devices with different levels of threat differently to save computing resources of the information detection module.

[0171] Continuously detect all packets forwarded by some interfaces, monitor network attacks and potential threats in real time, and report alarm information in a timely manner.

[0172] This implementation provides a real-time information detection network switching system suitable for scenarios with high security requirements. It is deployed at the core layer or access layer of networks that communicate with external networks or the Internet, monitors internal and external network communications, and protects the internal network from attacks or surveillance from external networks. It meets the following requirements:

[0173] Requirement 1: Low latency: The device performs message parsing and storage once, and multiple hardware modules independently look up tables, ensuring a relatively constant latency of less than 100µs.

[0174] Requirement 2: High bandwidth: Even with all access control rules configured, line-speed forwarding can still be achieved. This avoids the drawback of traditional devices where the more rules a device has, the lower the forwarding bandwidth.

[0175] Requirement 3: High reliability: On the one hand, the device itself is not affected by network message attacks; on the other hand, even if the processor and operating system have malfunctions, it will not affect the hardware's ability to forward messages.

[0176] Requirement 4: Low power consumption: FPGA chips have lower power consumption than multi-core processors.

[0177] Requirement 5. Have the function of resisting server attacks. Support MAC and IP binding; support mainstream denial of service attack protection, can actively defend against various flooding attacks such as fragment flooding, UDP flooding, TCP SYN flooding, ICMP flooding, etc.; support anti-source routing attack, anti-land_attack attack, anti-ping_of_death attack, anti-winnuke attack; support access control of special-shaped messages, support management of unknown layer 2 messages, unknown layer 3 messages, overlong ICMP messages, too short fragment messages, illegal IP, UDP checksum error messages, etc.; support TCP / IP protocol family risk message inspection and protection, support TCP SYN fragment message, TCP FIN fragment message, TCPRST fragment message management, support IP option inspection, TCP flag inspection, layer 3 security inspection, layer 4 security inspection;

[0178] Requirement 6: Network access control function. The primary rule supports 12 tuples, and the secondary rule supports 4 custom fields. Different access rules are allowed for flows with specified source ports and destination ports. Not only does it support passing and discarding, but it also supports forwarding to the processor, realizing combined rules for software and hardware collaboration.

[0179] The present invention is not limited to the above-mentioned embodiments. On the basis of the technical solutions disclosed in the present invention, those skilled in the art can make some substitutions and modifications to some of the technical features therein according to the disclosed technical content without creative labor, and these substitutions and modifications are all within the protection scope of the present invention.

Claims

1. A real-time information detection network switching system, comprising an information detection network switching device, wherein the information detection network switching device comprises a CPU processor, a switching chip, a reset system, a power supply, a clock, a hot-swap system and a management system; a network interface is provided at the front end of the switching chip, characterized in that: The information detection network switching device is arranged at the core layer or the access layer; It also includes an information detection module connected between the CPU processor and the switching chip, The information detection module is connected to the switching chip through at least two 10 Gigabit Ethernet interfaces. During the data message switching process in the network, the switching chip forwards the message of the required interface to the information detection module through a virtual routing forwarding protocol. The information detection module performs detection, filtering and alarm according to the set rules; The information detection module is connected to the CPU processor through PCI-E and a Gigabit Ethernet interface. When the information detection module finds a threat data message, it warns the CPU processor through the PCI-E and the Gigabit Ethernet interface. After the CPU processor receives the alarm information, it controls the switching chip and the information detection module to block the threat data message. The information detection module includes an FPGA chip, a storage chip, a DDR3 memory, an RS232 conversion chip, a reset chip and a connector. The FPGA chip is connected to the storage chip via an SPI interface and is also connected to the DDR3 memory via a DDR3 interface; the FPGA chip is connected to the CPU processor via PCIE and is also connected to the switching chip via two 10 Gigabit Ethernet interfaces; The information detection module divides data processing into a data channel and a control channel. The data channel is responsible for data storage and forwarding, and the control channel is responsible for function processing and notifies the data channel of instructions through forwarding information. The data channel mainly includes input / output interface module, input / output segmented storage, input / output read / write arbitration, read / write data cache, cache management, queue scheduling management module, interrupt controller and CPU control channel. In order to reduce the load of CPU, high-speed PCIE interface and DMA controller are integrated; The FPGA chip stores information detection software, which has the function of resisting server attacks and supports the binding of MAC and IP; The information detection software also has a network access control function: the primary rule supports 12 tuples, and the secondary rule supports 4 custom fields; different access rules are allowed for flows of specified source ports and destination ports; it supports passing and discarding, forwarding to the processor, and realizing a combination of rules for software and hardware collaboration.

2. A real-time information detection network exchange system according to claim 1, characterized in that: The information detection software also supports mainstream denial of service attack protection, flooding attack; supports anti-source routing attack, anti-land_attack attack, anti-ping_of_death attack, anti-winnuke attack; supports access control of special-shaped messages, supports management of unknown layer 2 messages, unknown layer 3 messages, too long ICMP messages, too short fragment messages, illegal IP, UDP checksum error messages; Supports TCP / IP protocol family risk message inspection and protection, supports TCP SYN fragment message, TCP FIN fragment message, TCP RST fragment message management, supports IP option inspection, TCP flag inspection, 3-layer security inspection and 4-layer security inspection.

3. A real-time information detection network exchange system according to claim 1, characterized in that: The setting rule of the information detection module is: by monitoring the data message characteristics in the network system, prevent special messages from the external network in a specific period.

4. A real-time information detection network exchange system according to claim 3, characterized in that: The data message features in the monitoring network system include message information filtering processing: providing matching rules based on Layer 2-5 data message features, allowing users to set filtering rules based on message information fields.

5. A real-time information detection network exchange system according to claim 1, characterized in that: A network configuration is provided in the switching chip to realize external data of different ports and control whether the external data needs to be detected; Specifically: The external communication between terminal A and terminal B needs to be sent to the information detection module. Or terminal C does not need to send information to the information detection module for external communication, and directly forwards it in the information access switching chip.

Images