Network security monitoring device based on FPGA reconfigurable computing and design method
By using the combination of I/O FPGA chip and Computing FPGA chip in FPGA network security monitoring and using PS configuration, the system interruption and resource consumption problems caused by FPGA reconstruction in the prior art are solved, and an efficient and reliable network is achieved. Security monitoring improves the real-time and stability of the system and reduces the risk of external intrusion.
Patent Information
- Application Number
- CN202411373509.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-29
- Publication Date
- 2024-12-27
AI Technical Summary
The existing FPGA reconfigurable technology has problems such as short system interruption during reconstruction, large resource consumption, unreliability and insufficient stability in network security monitoring, which affects the real-time and reliability of network security monitoring.
Using a reconfigurable computing device based on FPGA, the combination of I/O FPGA chip, Computing FPGA chip and general-purpose microprocessor is used to configure it using PS to achieve seamless reconstruction and change of logic functions, and avoid the chip from exiting the working mode. Shorten the reconstruction time and improve system stability and adaptability.
It realizes efficient and reliable network security monitoring, quickly adjusts monitoring strategies, reduces the risk of external equipment intrusion, and ensures the safe operation of power grid equipment.
Smart Images
Figure CN119210861A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of network security monitoring, and in particular to a network security monitoring device and a design method based on FPGA reconfigurable computing. Background Art
[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.
[0003] At present, all walks of life have higher and higher requirements for network security. Taking the power grid companies in various regions as an example, there are still many deficiencies in the network security monitoring of the equipment in each centralized control center and the equipment in the power plants under the jurisdiction of each centralized control center, which may lead to the equipment being invaded and the existence of network security risks. How to efficiently monitor network security is an important research topic for technicians in this field.
[0004] FPGA (Field-Programmable Gate Array) is a semi-customized circuit in the field of application-specific integrated circuits. It has the characteristics of high integration, small size, rich internal logic resources, rich interfaces, high real-time performance, and strong parallel capability. Introducing FPGA reconfigurable technology into the field of network security can achieve efficient, reliable and stable network security monitoring. However, it was found in the study that when the existing technology introduces FPGA reconfigurable technology into network security monitoring, the FPGA stores the configuration data in an external serial EPROM. This method has three disadvantages: the entire FPGA must be stopped before reconstruction, which will cause a short interruption of the system and affect the real-time and continuity of network security monitoring; only the entire FPGA is reconstructed, resulting in more resource consumption; the previous internal state of the FPGA cannot be saved during reconstruction, which will extend the reconstruction time, increase the system unavailable time, and affect the reliability and stability of network security monitoring. In addition, the configuration method in the prior art adopts a reconstruction method. The existing reconstruction method is an Off-Chip method that requires external logic support. Similar to static reconstruction, it is a reconstruction method that transmits configuration information to the configuration memory of the chip through a serial port or parallel port. During reconstruction, under the control of external logic, the configuration information is transmitted to the configuration memory through a serial port or parallel port circuit. The configuration memory then loads the configuration information software vertically and horizontally into the logic unit inside the FPGA to perform global or local functional modifications on the chip logic. This traditional Off-Chip reconstruction method takes a long time and is not suitable for network security monitoring scenarios with high real-time requirements. Its lack of stability and reliability increases the risk of external intrusion of power plant equipment and constitutes a network security risk that cannot be ignored. Therefore, exploring more efficient, stable and secure reconstruction strategies is crucial to ensure the continuity and effectiveness of network security monitoring. Summary of the invention
[0005] In order to solve the above problems, the present invention proposes a network security monitoring device and a design method based on FPGA reconfigurable computing, which reduces the reconstruction time while improving the stability and reliability of the network security monitoring device and realizes efficient network security monitoring.
[0006] In order to achieve the above object, the present invention adopts the following technical solution:
[0007] In a first aspect, the present invention provides a network security monitoring device based on FPGA reconfigurable computing, comprising:
[0008] A general-purpose microprocessor, an input-output unit and a reconfigurable processing unit; the input-output unit is interactively connected to the reconfigurable processing unit via a bus; the general-purpose microprocessor is interactively connected to the reconfigurable processing unit via a bus, and the general-purpose microprocessor is used to send a control signal to the reconfigurable processing unit;
[0009] The reconfigurable processing unit is an FPGA configuration circuit, including: an I / O FPGA chip, a first Computing FPGA chip, and a second Computing FPGA chip, wherein the I / O FPGA chip is interactively connected with the first Computing FPGA chip and the second Computing FPGA chip respectively; the I / O FPGA chip is used to receive a control signal, send it to the first Computing FPGA chip and the second Computing FPGA chip, and start a configuration process, and the first Computing FPGA chip and the second Computing FPGA chip are used to send a feedback signal and configuration data to the I / O FPGA chip;
[0010] The control signals include RESTART=0 signal, RESTART=1 signal, nCONFIG signal, clock DCLK signal and data DATA signal; the feedback signals include nSTATUS signal, CONF_DONE signal and INIT_DONE signal; after configuration, the reconfigurable processing unit has rule matching and network forwarding functions that can be used for network security monitoring.
[0011] According to a further technical solution, the I / O FPGA chip includes: a cache, an FPGA configuration logic module, a control logic chip, and a PCI-X bridge, wherein the cache and the control logic chip are used to receive control signals; the PCI-X bridge is used to receive configuration data sent by the first Computing FPGA chip and the second Computing FPGA chip, and transmit the configuration data to the cache in the cache, and the FPGA configuration logic module is used to read the control signals in the cache and the control logic chip and receive feedback signals sent by the first Computing FPGA chip and the second Computing FPGA chip.
[0012] According to a further technical solution, the buffer is a dual-clock FIFO.
[0013] According to a further technical solution, the I / O FPGA chip also includes an arbitration module, and the cache, control logic chip and PCI-X bridge are all connected to the arbitration module, wherein the control logic chip is connected to the arbitration module through a control register, and the cache and PCI-X bridge are directly connected to the arbitration module.
[0014] According to a further technical solution, the FPGA configuration logic module is configured in a PS mode, and the PS mode configuration process is as follows:
[0015] The nCONFIG signal first generates a low pulse, and the nSTATUS signal and the CONF_DONE signal are pulled low. At this time, the first Computing FPGA chip and the second Computing FPGA chip enter the reset state; then after the nCONFIG signal rises, the nSTATUS signal subsequently becomes high, and the first Computing FPGA chip and the second Computing FPGA chip enter the configuration state. After a delay of at least 40μs, the clock DCLK signal and the data DATA signal are valid; when the CONF_DONE signal is pulled high, the first Computing FPGA chip and the second Computing FPGA chip enter the initialization state, and finally the first Computing FPGA chip and the second Computing FPGA chip output the INIT_DONE signal.
[0016] According to a further technical solution, the INIT_DONE signal is output as low after being enabled, and jumps to high after the initialization is completed, indicating that the first Computing FPGA chip and the second Computing FPGA chip enter a working state.
[0017] According to a further technical solution, when an error occurs in the PS mode configuration, the nSTATUS signal will be pulled low, and the configuration will be restarted.
[0018] According to a further technical solution, both the first Computing FPGA chip and the second Computing FPGA chip include an enable output terminal and an enable input terminal, the enable input terminal of the first Computing FPGA chip is grounded, and the enable output terminal of the first Computing FPGA chip is connected to the input terminal of the second Computing FPGA chip.
[0019] In a second aspect, the present invention provides a design method for a network security monitoring device based on FPGA reconfigurable computing, the design method comprising the following process:
[0020] The general microprocessor sends a control signal to the buffer, the FPGA configuration logic module reads the control signal in the buffer, the FPGA configuration logic module transmits the control signal to the first Computing FPGA chip and the second Computing FPGA chip, and starts the configuration process. The FPGA configuration logic module is configured in a PS manner, and the first Computing FPGA chip and the second Computing FPGA chip send feedback signals to the FPGA configuration logic module; after the configuration is completed, the reconfigurable processing unit has rule matching and network forwarding functions that can be used for network security monitoring.
[0021] Compared with the prior art, the present invention has the following beneficial effects:
[0022] The FPGA configuration logic module in the I / O FPGA chip of the present invention is configured in PS mode, and can complete the reconstruction and modification of the logic function without exiting the working mode, thereby realizing the I / O FPGA chip to seamlessly complete network security monitoring of various different logic functions; this network security monitoring technology based on reconfigurable computing does not require the chip to exit the working mode during the implementation process, so it has strong real-time performance, and can ensure that the system can quickly adjust the monitoring strategy when facing security threats, and effectively protect network security; the present invention provides users with very good multi-functional reconstruction needs, so that users can smoothly realize complex network security monitoring functions under limited logic resource conditions; in the face of the complex monitoring environment in the field of network security, the present invention shows higher adaptability and flexibility, and better cope with the complex monitoring environment of network security.
[0023] The network security monitoring device based on reconfigurable computing provided by the present invention greatly shortens the reconstruction time, can better improve the speed of network security monitoring, realize reliable and stable network security monitoring, can avoid the intrusion of external devices into power grid equipment to the greatest extent, and protect the safe operation of power grid equipment. BRIEF DESCRIPTION OF THE DRAWINGS
[0024] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.
[0025] Figure 1 It is a structural schematic diagram of a network security monitoring device based on reconfigurable computing of the present invention;
[0026] Figure 2 A circuit diagram of the FPGA configuration circuit of the present invention;
[0027] Figure 3 It is the state transition diagram of the FPGA configuration logic module of the present invention;
[0028] Figure 4 This is a configuration timing diagram of the FPGA configuration logic module of the present invention. DETAILED DESCRIPTION
[0029] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.
[0030] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present invention belongs.
[0031] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.
[0032] Embodiment 1
[0033] This embodiment provides a network security monitoring device based on a reconfigurable computing accelerator, such as Figure 1 As shown, the data, programs or rule sets required for network security monitoring in the system are stored in the memory. In the dedicated hardware of the reconfigurable processing unit and the general-purpose microprocessor, the controller directly connected to the network security monitoring device and the cache of the processing unit constitute the local memory. The memory, the local memory, the general-purpose microprocessor, the input-output unit and the reconfigurable processing unit constitute the detection device, wherein the input-output unit is in the input buffer and the output buffer of the memory, and is used to process the transmission and storage of input and output data. It is interactively connected with the reconfigurable processing unit through a bus, receives data requests or instructions from the reconfigurable processing unit, and transmits processing results or data of external devices to the reconfigurable processing unit; the general-purpose microprocessor is interactively connected with the reconfigurable processing unit through a bus, and the general-purpose microprocessor is used to send control signals to the reconfigurable processing unit, specifically: Figure 2As shown, the reconfigurable processing unit is an FPGA configuration circuit, including: an I / O FPGA chip, a first Computing FPGA chip, and a second Computing FPGA chip, wherein the I / O FPGA chip is interactively connected with the first Computing FPGA chip and the second Computing FPGA chip respectively, and the first Computing FPGA chip and the second Computing FPGA chip both include an enable output terminal and an enable input terminal, the enable input terminal of the first Computing FPGA chip is grounded, and the enable output terminal of the first Computing FPGA chip is connected to the input terminal of the second Computing FPGA chip, the I / O FPGA chip is used to receive a control signal, and send it to the first Computing FPGA chip and the second Computing FPGA chip, and start the configuration process, the first Computing FPGA chip and the second Computing FPGA chip are used to send feedback signals and configuration data to the I / O FPGA chip, and when the configuration is completed, the above-mentioned reconfigurable processing unit has rule matching and network forwarding functions that can be used for network security monitoring.
[0034] The control signals received and sent by the I / O FPGA chip include RESTART=0 signal, RESTART=1 signal, nCONFIG signal, clock DCLK signal and data DATA signal; the feedback signals sent by the first Computing FPGA chip and the second Computing FPGA chip to the I / O FPGA chip include nSTATUS signal, CONF_DONE signal and INIT_DONE signal.
[0035] like Figure 2As shown in the circuit diagram of the FPGA configuration circuit, the I / O FPGA chip includes: a buffer, an FPGA configuration logic module, a control logic chip, and a PCI-X bridge, wherein the buffer is a dual-clock FIFO with a width of 8 bits and a word depth of 4KB. The buffer and the control logic chip in the I / O FPGA chip are used to receive and send control signals. The buffer receives and sends nCONFIG signals, clock DCLK signals, and data DATA signals, and the control logic chip receives and sends RESTART=0 signals and RESTART=1 signals. The PCI-X bridge is used to receive data generated by the FPGA design software for configuring the internal logical structure and function of the FPGA chip and sent by the first Computing FPGA chip and the second Computing FPGA chip, that is, the configuration data is received through the PCI-X bridge and transmitted to the buffer. The FPGA configuration logic module is used to read the control signals in the buffer and the control logic chip and receive feedback signals sent by the first Computing FPGA chip and the second Computing FPGA chip. In addition, it is also as follows Figure 2 As shown, the I / O FPGA chip also includes an arbitration module and several high-speed serial data interfaces, and the buffer, control logic chip and PCI-X bridge are all connected to the arbitration module, wherein the control logic chip is connected to the arbitration module through the control register, and the buffer and PCI-X bridge are directly connected to the arbitration module, and one end of several high-speed serial data interfaces is connected to the arbitration module, and the other end is connected to other high-speed data transmission devices or system components, such as FPGA chips, ASICs, DSPs, high-speed memories, network interface controllers, sensors, actuators and other high-performance computing units. .
[0036] For the FPGA configuration logic module, after the system is powered on and needs to be reconstructed, the PCI-X bridge in the I / O FPGA will receive the configuration data sent by the first Computing FPGA chip and the second Computing FPGA chip, and write the configuration data into the buffer. The buffer will send RD_ENPTY=1 signal and RD_ENPTY=0 signal to indicate whether it is empty. When the FPGA configuration logic module reads the RD_ENPTY=1 signal, it means reading empty, then suspend the configuration and wait for the configuration data to be written into the buffer.
[0037] like Figure 3 As shown in the state transition diagram of the FPGA configuration logic module, in this embodiment, the FPGA configuration logic module adopts the PS mode configuration and monitors the configuration state. The specific PS mode configuration is as follows:
[0038] To reiterate: RESTART=0 signal and RESTART=1 signal come from the control logic chip, RD_ENPTY=1 signal, RD_ENPTY=0 signal, nCONFIG signal, data DATA signal and clock DCLK signal come from the buffer, and nSTATUS signal and CONF_DONE signal come from the first Computing FPGA chip and the second Computing FPGA chip;
[0039] After power-on, the FPGA configuration logic module enters the start state. At this time, the RESTART=0 signal is read. When the RESTART=1 signal in the control logic chip is read, the first Computing FPGA chip and the second Computing FPGA chip are configured. First, a 40μs nCONFIG low pulse is sent for reset, and then a clock DCLK signal with a frequency of 100MHz is sent after a 40μs delay. When the synchronous clock is valid, the FPGA configuration logic module reads the 8-bit wide data in the buffer in sequence at a clock frequency of 12.5MHz, with the low bit in front and the high bit in the back, and changes in parallel. At the same time, the data DATA signal line and the clock DCLK signal are sent to the first Computing FPGA chip and the second Computing FPGA chip, and the first Computing FPGA chip and the second Computing FPGA chip send nSTATUS signal and CONF_DONE signal to the FPGA configuration logic module. During this period, if the first Computing FPGA chip and the second Computing FPGA chip When the FPGA chip detects an error, it will send the nSTATUS=0 signal, and the FPGA configuration logic module will jump to the start state. If the FPGA configuration logic module receives the RD_ENPTY=1 signal, it will pause the configuration and wait for the configuration data to be written into the buffer. It will restart the configuration after receiving the RD_ENPTY=0 signal.
[0040] Combination Figure 4 The configuration timing diagram of the FPGA configuration logic module shows the process of PS as follows:
[0041] The nCONFIG signal first generates a low pulse, and the nSTATUS signal and CONF_DONE signal are pulled low. At this time, the first Computing FPGA chip and the second Computing FPGA chip enter the reset state; then after the nCONFIG signal rises, the nSTATUS signal subsequently becomes high, and the first Computing FPGA chip and the second Computing FPGA chip enter the configuration state. After at least 40μs of delay, the clock DCLK signal and the data DATA signal are valid; when the CONF_DONE signal is pulled high, the first Computing FPGA chip and the second Computing FPGA chip enter the initialization state, and finally the first Computing FPGA chip and the second Computing FPGA chip output the INIT_DONE signal. After the INIT_DONE signal is enabled, the output is low, and after the initialization is completed, it jumps to high, indicating that the first Computing FPGA chip and the second Computing FPGA chip enter the working state. And if an error occurs in the PS mode configuration, the nSTATUS signal will be pulled low, and the configuration will be restarted.
[0042] Embodiment 2
[0043] This embodiment provides a network security monitoring device based on reconfigurable computing based on the first embodiment, and further proposes a design method for a network security monitoring device based on reconfigurable computing:
[0044] The general microprocessor sends a control signal to the buffer, the FPGA configuration logic module reads the control signal in the buffer, the FPGA configuration logic module transmits the control signal to the first Computing FPGA chip and the second Computing FPGA chip, and starts the configuration process. The FPGA configuration logic module is configured in a PS manner, and the first Computing FPGA chip and the second Computing FPGA chip send feedback signals to the FPGA configuration logic module; after the configuration is completed, the reconfigurable processing unit has rule matching and network forwarding functions that can be used for network security monitoring.
[0045] It should be noted here that each module in this embodiment corresponds one-to-one to the method in Embodiment 1, and the specific implementation process is the same, which will not be repeated here.
[0046] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.
[0047] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.
Claims
1. A network security monitoring device based on FPGA reconfigurable computing, characterized in that: include: General purpose microprocessors, input-output units, and reconfigurable processing units; The input-output unit is interactively connected to the reconfigurable processing unit via a bus; the general-purpose microprocessor is interactively connected to the reconfigurable processing unit via a bus, and the general-purpose microprocessor is used to send a control signal to the reconfigurable processing unit; The reconfigurable processing unit is an FPGA configuration circuit, including: an I / O FPGA chip, a first Computing FPGA chip, and a second Computing FPGA chip, wherein the I / O FPGA chip is interactively connected with the first Computing FPGA chip and the second Computing FPGA chip respectively; the I / O FPGA chip is used to receive a control signal, and send it to the first Computing FPGA chip and the second Computing FPGA chip, and start a configuration process, and the first Computing FPGA chip and the second Computing FPGA chip are used to send a feedback signal and configuration data to the I / O FPGA chip; The control signals include RESTART=0 signal, RESTART=1 signal, nCONFIG signal, clock DCLK signal and data DATA signal; the feedback signals include nSTATUS signal, CONF_DONE signal and INIT_DONE signal; after configuration, the reconfigurable processing unit has rule matching and network forwarding functions that can be used for network security monitoring.
2. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 1, characterized in that: The I / O FPGA chip includes: a buffer, an FPGA configuration logic module, a control logic chip, and a PCI-X bridge, wherein the buffer and the control logic chip are used to receive control signals; the PCI-X bridge is used to receive configuration data sent by the first Computing FPGA chip and the second Computing FPGA chip, and transmit the configuration data to the buffer for caching; the FPGA configuration logic module is used to read the control signals in the buffer and the control logic chip and receive feedback signals sent by the first Computing FPGA chip and the second Computing FPGA chip.
3. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 2, characterized in that: The buffer is a dual-clock FIFO.
4. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 2, characterized in that: The I / O FPGA chip also includes an arbitration module, and the buffer, control logic chip and PCI-X bridge are all connected to the arbitration module, wherein the control logic chip is connected to the arbitration module through a control register, and the buffer and PCI-X bridge are directly connected to the arbitration module.
5. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 1, characterized in that: The I / O FPGA chip also includes a plurality of high-speed serial data interfaces, and the plurality of high-speed serial data interfaces are connected to the arbitration module.
6. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 1, characterized in that: The FPGA configuration logic module is configured in PS mode, and the PS mode configuration process is as follows: The nCONFIG signal first generates a low pulse, and the nSTATUS signal and the CONF_DONE signal are pulled low. At this time, the first Computing FPGA chip and the second Computing FPGA chip enter the reset state; then after the nCONFIG signal rises, the nSTATUS signal subsequently becomes high, and the first Computing FPGA chip and the second Computing FPGA chip enter the configuration state. After a delay of at least 40μs, the clock DCLK signal and the data DATA signal are valid; when the CONF_DONE signal is pulled high, the first Computing FPGA chip and the second Computing FPGA chip enter the initialization state, and finally the first Computing FPGA chip and the second Computing FPGA chip output the INIT_DONE signal.
7. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 6, characterized in that: The INIT_DONE signal is output as low after being enabled, and jumps to high after the initialization is completed, indicating that the first Computing FPGA chip and the second Computing FPGA chip enter the working state.
8. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 6, characterized in that: When an error occurs in the PS mode configuration, the nSTATUS signal will be pulled low and the configuration will be restarted.
9. The network security monitoring device based on FPGA reconfigurable computing as claimed in claim 1, characterized in that: The first Computing FPGA chip and the second Computing FPGA chip both include an enable output terminal and an enable input terminal. The enable input terminal of the first Computing FPGA chip is grounded, and the enable output terminal of the first Computing FPGA chip is connected to the input terminal of the second Computing FPGA chip.
10. A design method for a network security monitoring device based on FPGA reconfigurable computing according to any one of claims 1 to 9, the design method comprising the following process: The general microprocessor sends a control signal to the buffer, the FPGA configuration logic module reads the control signal in the buffer, the FPGA configuration logic module transmits the control signal to the first Computing FPGA chip and the second Computing FPGA chip, and starts the configuration process. The FPGA configuration logic module is configured in a PS manner, and the first Computing FPGA chip and the second Computing FPGA chip send feedback signals to the FPGA configuration logic module. After the configuration is completed, the reconfigurable processing unit has rule matching and network forwarding functions that can be used for network security monitoring.