Method, device and module for realizing network security function of EPA
By using a combination of ZYNQ chips and PHY chips in EPA devices, it is possible to provide network security functions for industrial equipment at a simple and low cost without changing existing equipment, and solve the complex security functions of EPA equipment in the prior art. And the high cost issue enhances the safe isolation and adaptability of the equipment.
Patent Information
- Application Number
- CN202411292506.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-09-14
- Publication Date
- 2024-12-31
AI Technical Summary
In the prior art, EPA's network security function requires the use of security equipment compatible with EPA protocol, which makes it difficult to achieve simple and low-cost security on general industrial equipment such as desktops and industrial control machines. Function.
By designing a module implemented by EPA's network security function, the module consists of a programmable processor ZYNQ chip and an Ethernet physical layer PHY chip, using a high-speed serial computer to extend the bus standard PCIE interface to obtain and isolate the Data, and enable secure isolation and data transmission through data isolation algorithms and security policies without changing existing devices.
It realizes the EPA network security function for general industrial equipment at a simple and low cost without changing existing equipment, enhances the safety isolation capability and flexibility of the equipment, and is adapted to most industrial control machines and on-site control equipment. .
Smart Images
Figure CN119232446A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of programmable processor chips, and in particular to a method, device and module for implementing the network security function of an EPA. Background Art
[0002] Ethernet for Plant Automation (EPA) is a network based on real-time industrial Ethernet, which can connect several devices, small modules and control / monitoring devices distributed on site, so that all devices can work together to complete the measurement and control of industrial production processes and operations. Considering the high status of EPA in industrial automation control, the safety of EPA is also very important.
[0003] In the prior art, the network security function of EPA can only be realized by using security equipment compatible with the EPA protocol, which is not flexible enough. If the network security function of EPA needs to be realized on general industrial equipment such as desktop computers and industrial computers, it is often necessary to transform and develop the entire industrial equipment, which is complicated and takes a lot of time and money. Therefore, it has become an urgent problem to enable general industrial equipment to realize the network security function of EPA simply and at low cost. Summary of the invention
[0004] Based on the above problems, the present application provides a method, device and module for implementing the network security function of EPA, so that general industrial equipment can implement the network security function of EPA simply and at low cost.
[0005] The present application discloses a method for realizing the network security function of an EPA, the method being realized by a module for realizing the network security function of an EPA, the module being configured on a target device in a physical form matching an expansion slot of a high-speed serial computer expansion bus standard PCIE, the method comprising:
[0006] Respectively obtain data from different network ports; the data includes general data and real-time data of the target device; the real-time data is obtained based on the factory automation Ethernet EPA bus chip of the module;
[0007] When the programmable processor ZYNQ chip of the module selects the security isolation mode, the data from different network ports are securely isolated through the data isolation algorithm;
[0008] The data of each network port after security isolation is uploaded to the processor through the PCIE interface or processed internally.
[0009] Optionally, the acquiring data from different network ports respectively includes:
[0010] The Ethernet physical layer PHY chip of the module obtains general data differential signals from the service Ethernet port and obtains real-time data differential signals from the real-time Ethernet port; the PHY chip corresponds to the network port one by one;
[0011] The PHY chip of the module converts the general data differential signal into the general data in the form of a digital signal, and converts the real-time data differential signal into the real-time data in the form of a digital signal.
[0012] Optionally, the method further includes:
[0013] When the ZYNQ chip of the module selects the transparent transmission mode, the data from different network ports are not processed.
[0014] Based on the above method for implementing the network security function of an EPA, the present application also discloses a device for implementing the network security function of an EPA, which is used in the above method, and the device includes: an acquisition unit, an isolation unit, and a processing unit;
[0015] The acquisition unit is used to respectively acquire data from different network ports; the data includes general data and real-time data of the target device; the real-time data is acquired based on the factory automation Ethernet EPA bus chip of the module;
[0016] The isolation unit is used to safely isolate data from different network ports through a data isolation algorithm when the programmable processor ZYNQ chip of the module selects a secure isolation mode;
[0017] The processing unit is used to upload the data of each network port after security isolation to the processor through the PCIE interface or perform internal processing.
[0018] Optionally, the acquisition unit includes:
[0019] An acquisition subunit, used for the Ethernet physical layer PHY chip of the module to acquire general data differential signals from the service Ethernet port and real-time data differential signals from the real-time Ethernet port; the PHY chip corresponds to the network port one by one;
[0020] The conversion subunit is used for the PHY chip of the module to convert the general data differential signal into the general data in the form of a digital signal, and to convert the real-time data differential signal into the real-time data in the form of a digital signal.
[0021] Optionally, the device further comprises:
[0022] The transparent transmission unit is used for not processing the data from different network ports when the ZYNQ chip of the module selects the transparent transmission mode.
[0023] Based on the above method for implementing the network security function of an EPA, the present application also discloses a module for implementing the network security function of an EPA, which is used to implement the above method, and the module includes:
[0024] A PHY chip is used to convert the differential signal from the network port into a digital signal to obtain data from different network ports; the data includes general data and real-time data; the real-time data is obtained based on the EPA bus chip of the module;
[0025] The ZYNQ chip is used to receive data from the different network ports of the PHY chip, and to achieve secure isolation between the data of the different network ports, and to upload the securely isolated data to the processor through the PCIE interface or to perform internal processing;
[0026] The EPA bus chip is used to receive the real-time data from the PHY chip.
[0027] Optionally, the different network ports include two real-time Ethernet ports for acquiring real-time data differential signals, and two service Ethernet ports for acquiring general data differential signals.
[0028] Optionally, the PHY chip corresponds to the network port one by one, the PHY chip corresponding to the real-time Ethernet port is connected to the EPA bus chip through the RGM1 interface, and the PHY chip corresponding to the business Ethernet port is connected to the programmable logic PL end of the ZYNQ chip through the RGM1 interface.
[0029] Optionally, the serializer / deserializer channel of the ZYNQ chip of the module is instantiated as an interface between PCIE and the processor, and the ZYNQ chip of the module transmits data with the processor through the instantiated interface.
[0030] Optionally, the size of the module is a half-height and half-length size that matches the expansion slot of the PCIE.
[0031] Optionally, the ZYNQ chip of the module is also used for:
[0032] Configure a preset security policy and process the data of the different network ports according to the security policy; the security policy includes a filtering mechanism, encryption measures and a security algorithm.
[0033] The present application discloses a method, device and module for realizing the network security function of EPA. The module described in the present application is a physical form that matches the expansion slot of PCIE, and can be adapted to most industrial computers, field control equipment and ordinary commercial machines. Based on the EPA bus chip, real-time data is obtained, and the device after configuring this module has real-time network data transmission function without changing the existing equipment. And when the ZYNQ chip selects the security isolation mode, data from different network ports can be safely isolated through the data isolation algorithm. Similarly, without changing the existing equipment, the device after configuring this module has the function of data security isolation. Subsequently, the module described in the present application can upload the data of each network port after security isolation to the processor through the PCIE interface or perform internal processing. The module described in the present application has strong compatibility and is easy to expand, which can enable general industrial equipment to realize the network security function of EPA simply and at low cost. In addition, the ZYNQ chip in the module can be configured with various security policies and driver configurations, with high flexibility. BRIEF DESCRIPTION OF THE DRAWINGS
[0034] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.
[0035] Figure 1 A flowchart of a method for realizing a network security function of an EPA disclosed in an embodiment of the present application;
[0036] Figure 2 A flowchart of another method for realizing the network security function of EPA disclosed in an embodiment of the present application;
[0037] Figure 3 A schematic diagram of the structure of a device for realizing the network security function of an EPA disclosed in an embodiment of the present application;
[0038] Figure 4 A schematic diagram of the structure of a module for implementing the network security function of an EPA disclosed in an embodiment of the present application. DETAILED DESCRIPTION
[0039] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0040] Embodiment 1: This application discloses a method for implementing the network security function of EPA.
[0041] For details, please refer to Figure 1 The method for implementing the network security function of an EPA disclosed in this embodiment includes the following steps:
[0042] Step 101: Obtain data from different network ports respectively.
[0043] The method described in this embodiment is implemented by a module that realizes the network security function of an EPA disclosed in this application. The module design described in this embodiment is based on the high-performance processor PS and rich internal programmable logic PL inside the programmable processor ZYNQ chip to realize the security isolation function of the EPA. First of all, the module as a whole is a high-speed serial computer expansion bus standard PCIE (Peripheral Component Interconnect Express) standard form, that is, a physical form that matches the expansion slot of the PCIE. It can be widely configured in the PCIE standard expansion slot of industrial computers.
[0044] In the method described in this embodiment, the data in step 101 includes general data and real-time data of the target device. Among them, real-time data transmission is the main feature realized by the EPA bus chip, and the EPA bus chip can provide a real-time Ethernet port for obtaining real-time data therefrom.
[0045] As an optional method, in the process of acquiring data, the module described in this embodiment also has an Ethernet physical layer PHY chip, which can obtain general data differential signals from the service Ethernet port, obtain real-time data differential signals from the real-time Ethernet port, and convert the general data differential signals into general data in the form of digital signals, and convert the real-time data differential signals into real-time data in the form of digital signals. It should be noted that the PHY chip corresponds to the network port one by one.
[0046] Step 102: When the programmable processor ZYNQ chip of the module selects the security isolation mode, data from different network ports are securely isolated through a data isolation algorithm.
[0047] In the method described in this embodiment, the ZYNQ chip can select whether the data needs to be securely isolated according to the preset security policy. When the ZYNQ chip selects the secure isolation mode, the data from different network ports cannot be interoperable without processing and conversion. When the ZYNQ chip selects the transparent transmission mode, the data from different network ports is not processed, that is, the data from each network port is the original data. The secure isolation mode can ensure the data security between different network ports, prevent malicious data from causing adverse effects on other network ports, other device ports, etc., and effectively avoid further expansion of faults.
[0048] As an optional method, in the security isolation mode, the ZYNQ chip can perform security checks and other processing on data from different network ports. When the data is confirmed to be safe, it allows data from different network ports to communicate directly or indirectly.
[0049] Step 103: Upload the data of each network port after security isolation to the processor through the PCIE interface or perform internal processing.
[0050] In the method described in this embodiment, due to the programmable characteristics of the ZYNQ chip, it can configure preset security policies according to different scenario requirements, including filtering mechanisms, encryption measures, secure communication protocols and security algorithms, etc. And process data from different network ports according to the security policies.
[0051] As an optional method, the serializer / deserializer channel of the ZYNQ chip is instantiated as an interface between PCIE and the processor (PCIE EP interface), and the ZYNQ chip can transmit data with the processor through the instantiated interface. The instantiated interface of the ZYNQ chip can also be configured as different isolated network card devices, such as private character devices or standard network devices, by loading different driver configurations, so as to improve the flexibility of the module described in this embodiment.
[0052] In the method described in this embodiment, the ZYNQ chip, EPA bus chip and PHY chip are used to realize the acquisition of real-time data and the safe isolation of data from different network ports (data sources). This safe isolation mode ensures that the data security between different network ports can be guaranteed, and the expansion of faults can be effectively avoided. Moreover, the module described in this embodiment is in the form of PCIE standard, which can be widely used in PCIE standard expansion slots of industrial equipment such as industrial computers, and has strong scalability. There is no need to transform the whole device. After the device is configured with the module described in this embodiment, it can have real-time data transmission function and EPA safe isolation function, and realize the expansion and upgrading of device functions simply and at low cost. At the same time, the programmable ZYNQ chip is highly flexible and can be configured with different filtering mechanisms, encryption measures, security algorithms, etc. to selectively transmit network data. The ZYNQ chip instantiates the PCIE EP interface to load different driver configurations and configure it as different isolated network card devices.
[0053] Embodiment 2: This application discloses another method for implementing the network security function of EPA, please refer to Figure 2 The method described in this embodiment introduces the process of implementing the network security function of EPA.
[0054] Step 201: The ZYNQ chip of the module selects the security isolation mode, receives the real-time data of the device from the real-time Ethernet port, and receives the general data of the device from the business Ethernet port.
[0055] Step 202: After the ZYNQ chip of the module performs security isolation on the real-time data and the general data, the real-time data is uploaded to the main processor, and the general data is checked for compliance according to the preset program.
[0056] Step 203: After the main processor analyzes and processes the real-time data, it returns the relevant data to the module.
[0057] Step 204: The module receives the relevant data and sends it to the device through the service Ethernet port.
[0058] Step 205: forward the control information corresponding to the general data after the compliance check is passed to the real-time Ethernet port, and then sent to the device.
[0059] The method described in this embodiment discloses data transmission in two scenarios. In one scenario, the data of a real-time Ethernet port is uploaded to the main processor after being securely isolated from the data of other network ports. The main processor transmits the relevant data back, and the module sends the relevant data out through the business Ethernet port. In another scenario, the data of another business Ethernet port is checked for compliance after being securely isolated from the data of other network ports. After the check is correct, the control information corresponding to the data is directly forwarded to the real-time Ethernet port and sent out. The method described in this embodiment ensures that data from different channels are not interconnected and affect each other. When a fault caused by malicious data occurs, the data security of each network port can be guaranteed, thereby preventing malicious data from causing adverse effects on other ports through data interconnection and avoiding the expansion of the fault.
[0060] Based on the method for implementing the network security function of an EPA disclosed in the above embodiment, this embodiment correspondingly discloses a device for implementing the network security function of an EPA. Figure 3 , the device for realizing the network security function of the EPA is used to realize the above method, and the device includes: an acquisition unit 301, an isolation unit 302 and a processing unit 303;
[0061] The acquisition unit 301 is used to respectively acquire data from different network ports; the data includes general data and real-time data of the target device; the real-time data is acquired based on the factory automation Ethernet EPA bus chip of the module;
[0062] The isolation unit 302 is used to safely isolate data from different network ports through a data isolation algorithm when the programmable processor ZYNQ chip of the module selects a secure isolation mode;
[0063] The processing unit 303 is used to upload the data of each network port after security isolation to the processor through the PCIE interface or perform internal processing.
[0064] Optionally, the acquiring unit 301 includes:
[0065] An acquisition subunit, used for the Ethernet physical layer PHY chip of the module to acquire general data differential signals from the service Ethernet port and real-time data differential signals from the real-time Ethernet port; the PHY chip corresponds to the network port one by one;
[0066] The conversion subunit is used for the PHY chip of the module to convert the general data differential signal into the general data in the form of a digital signal, and to convert the real-time data differential signal into the real-time data in the form of a digital signal.
[0067] Optionally, the device further comprises:
[0068] The transparent transmission unit is used for not processing the data from different network ports when the ZYNQ chip of the module selects the transparent transmission mode.
[0069] Based on the method for implementing the network security function of an EPA disclosed in the above embodiment, this embodiment correspondingly discloses a module for implementing the network security function of an EPA. The device for implementing the network security function of an EPA includes:
[0070] A PHY chip is used to convert the differential signal from the network port into a digital signal to obtain data from different network ports; the data includes general data and real-time data; the real-time data is obtained based on the EPA bus chip of the module;
[0071] The ZYNQ chip is used to receive data from the different network ports of the PHY chip, and to achieve secure isolation between the data of the different network ports, and to upload the securely isolated data to the processor through the PCIE interface or to perform internal processing;
[0072] The EPA bus chip is used to receive the real-time data from the PHY chip.
[0073] Optionally, the different network ports include two real-time Ethernet ports for acquiring real-time data differential signals, and two service Ethernet ports for acquiring general data differential signals.
[0074] Optionally, the PHY chip corresponds to the network port one by one, the PHY chip corresponding to the real-time Ethernet port is connected to the EPA bus chip through the RGM1 interface, and the PHY chip corresponding to the business Ethernet port is connected to the programmable logic PL end of the ZYNQ chip through the RGM1 interface.
[0075] Optionally, the serializer / deserializer channel of the ZYNQ chip of the module is instantiated as an interface between PCIE and the processor, and the ZYNQ chip of the module transmits data with the processor through the instantiated interface.
[0076] Optionally, the size of the module is a half-height and half-length size that matches the expansion slot of the PCIE.
[0077] Optionally, the ZYNQ chip of the module is also used for:
[0078] Configure a preset security policy and process the data of the different network ports according to the security policy; the security policy includes a filtering mechanism, encryption measures and a security algorithm.
[0079] In the modules described in this embodiment, Figure 4 As shown in the figure, this module is mainly composed of ZYNQ chip, EPA bus chip and PHY chip. On the PS side of ZYNQ chip, there are the third generation double data rate synchronous dynamic random access memory DDR3 (Double-Data-Rate Three Synchronous Dynamic Random Access Memory), non-volatile memory FLASH (usually including two types of NOR FLASH and NAND FLASH), universal serial bus USB and debug interface UART / I2C. On the PL side of ZYNQ chip, the high-speed serializer / deserializer channel is instantiated as PCIE EP interface for communication with the main processor.
[0080] The module described in this embodiment is a standard PCIE half-height half-length standard size, which is convenient for application in the industrial computer PCIE standard expansion slot. A connector is provided under the module described in this embodiment, which provides power supply, management, clock, reset, PCIE 2.0 X4 / X8 and other interfaces through gold fingers, and is responsible for transmitting power supply voltage, data signal, clock signal, and ground signal.
[0081] In the module described in this embodiment, the PL side of the ZYNQ chip is connected to the EPA bus chip and can control and manage it and exchange data. The PL side is also connected to two PHY chips through the RGM1 interface to obtain data from the service Ethernet port through them. The EPA bus chip is also connected to two PHY chips through the RGM1 interface to obtain data from the real-time Ethernet port through them.
[0082] In the module described in this embodiment, four PHY chips are provided, which are respectively connected to four different network ports, that is, the module described in this embodiment provides two real-time Ethernet ports and two service Ethernet ports. The network port can specifically adopt Ethernet 8P8C electrical port RJ45.
[0083] The embodiments in this specification are described in a progressive manner. As for the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the description of the methods.
[0084] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0085] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0086] The features described in the embodiments of this specification can be replaced or combined with each other, so that professional and technical personnel in this field can implement or use the present application.
[0087] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for implementing the network security function of EPA, characterized in that: The method is implemented by a module for implementing the network security function of an EPA, wherein the module is configured on a target device in a physical form matching an expansion slot of a high-speed serial computer expansion bus standard PCIE, and the method comprises: Respectively obtain data from different network ports; the data includes general data and real-time data of the target device; the real-time data is obtained based on the factory automation Ethernet EPA bus chip of the module; When the programmable processor ZYNQ chip of the module selects the security isolation mode, the data from different network ports are securely isolated through the data isolation algorithm; The data of each network port after security isolation is uploaded to the processor through the PCIE interface or processed internally.
2. The method according to claim 1, characterized in that The data from different network ports are obtained respectively, including: The Ethernet physical layer PHY chip of the module obtains general data differential signals from the service Ethernet port and obtains real-time data differential signals from the real-time Ethernet port; the PHY chip corresponds to the network port one by one; The PHY chip of the module converts the general data differential signal into the general data in the form of a digital signal, and converts the real-time data differential signal into the real-time data in the form of a digital signal.
3. The method according to claim 1 or 2, characterized in that: The method further comprises: When the ZYNQ chip of the module selects the transparent transmission mode, the data from different network ports are not processed.
4. A device for realizing the network security function of EPA, characterized in that: Used to implement the method according to any one of claims 1 to 3, comprising: an acquisition unit, an isolation unit and a processing unit; The acquisition unit is used to respectively acquire data from different network ports; the data includes general data and real-time data of the target device; the real-time data is acquired based on the factory automation Ethernet EPA bus chip of the module; The isolation unit is used to safely isolate data from different network ports through a data isolation algorithm when the programmable processor ZYNQ chip of the module selects a secure isolation mode; The processing unit is used to upload the data of each network port after security isolation to the processor through the PCIE interface or perform internal processing.
5. A module for implementing the network security function of EPA, characterized in that: For implementing the method according to any one of claims 1 to 3, the module comprises: A PHY chip is used to convert the differential signal from the network port into a digital signal to obtain data from different network ports; the data includes general data and real-time data; the real-time data is obtained based on the EPA bus chip of the module; The ZYNQ chip is used to receive data from the different network ports of the PHY chip, and to achieve secure isolation between the data of the different network ports, and to upload the securely isolated data to the processor through the PCIE interface or to perform internal processing; The EPA bus chip is used to receive the real-time data from the PHY chip.
6. The module according to claim 5, characterized in that The different network ports include two real-time Ethernet ports for acquiring real-time data differential signals, and two service Ethernet ports for acquiring general data differential signals.
7. The module according to claim 6, characterized in that The PHY chip corresponds to the network port one by one. The PHY chip corresponding to the real-time Ethernet port is connected to the EPA bus chip through the RGMI l interface, and the PHY chip corresponding to the business Ethernet port is connected to the programmable logic PL end of the ZYNQ chip through the RGMI l interface.
8. The module according to claim 5, characterized in that The serializer / deserializer channel of the ZYNQ chip of the module is instantiated as an interface between PCIE and the processor, and the ZYNQ chip of the module performs data transmission with the processor through the instantiated interface.
9. The module according to claim 5, characterized in that The size of the module is a half-height and half-length size matching the expansion slot of the PCIE.
10. The module according to claim 5, characterized in that The module’s Zynq chip is also used to: Configure a preset security policy and process the data of the different network ports according to the security policy; the security policy includes a filtering mechanism, encryption measures and a security algorithm.