Switch port management method of vehicle-mounted Ethernet

Abstract

The invention discloses a switch port management method of a vehicle-mounted Ethernet. The method comprises the following steps: determining an Ethernet topology; the Ethernet topology comprises a main interaction domain controller with a switch and a small controller interacting with the domain controller; mAC addresses are distributed to a main interaction domain controller and a small controller, and a specific port number is distributed to the corresponding controller according to the connection requirement of each controller; planning an IP address space, and determining an IP address corresponding to each controller; firewall setting is enhanced for the controller related to interaction with the outside, and an inbound and outbound rule is configured. According to the invention, port management is adopted, and network flow is divided and isolated through physical ports, so that the network configuration is simplified, the complexity of a network architecture is reduced, and the cost is reduced; and by enhancing firewall setting and setting an inbound rule and an outbound rule, data packets entering and exiting the network are monitored and filtered, illegal access and unauthorized traffic transmission are limited, the security of the network is improved, and the risk that fine access control and traffic isolation cannot be provided is made up.

Description

Technical Field

[0001] The present invention relates to the field of vehicle communications, and in particular to a switch port management method for vehicle-mounted Ethernet. Background Art

[0002] Switches are common network devices. To better manage and control network traffic, switches provide different port modes. Although traditional VLAN division provides powerful network isolation and access control capabilities, its configuration is complex, costly, and not conducive to rapid deployment. In automotive Ethernet, in order to quickly respond to market changes, reduce development costs, and maintain basic network security and manageability, port management has become a feasible solution.

[0003] In the prior art, the vehicle Ethernet switch communication control method proposed in patent CN117082013A, the vehicle Ethernet switch obtains the port number and MAC address corresponding to the controller connected to the Ethernet switch through the static configuration of the vehicle software, and then generates an Ethernet switch forwarding table based on the port number and MAC address corresponding to the connected controller; when exchanging data, after receiving the Ethernet message, the vehicle Ethernet switch parses the target MAC address from the message, and then obtains the port number corresponding to the target MAC address through the Ethernet switch forwarding table, and then forwards the insulation data to the port number link corresponding to the target MAC address. The vehicle Ethernet switch has a TX port and a T1 port. The TX port is used to connect to an off-board diagnostic instrument or an external offline device. The vehicle switch configures the TX port to only allow Ethernet messages without VLAN tags to be sent to off-board devices through the TX port, and when receiving a diagnostic request message sent through the TX port, it adds a VLAN tag and then forwards it to the T1 port. The T1 port is used to connect to the ETH controller. The T1 port of the Ethernet switch is configured to allow multiple VLANs to pass through, receive and send messages from multiple VLANs. After receiving an Ethernet message from a certain T1 port, the switch keeps the VLAN tag unchanged and forwards it to the target T1 port. However, the initial configuration of VLANs is quite complicated and time-consuming. Each port on each switch needs to be configured accordingly according to the VLAN to which it belongs, which increases the workload of the network administrator. In addition, the flexibility is limited. When the physical address (MAC address) of the host changes, if the VLAN is divided based on the MAC address, then the VLAN to which the host belongs needs to be reconfigured, which may cause inconvenience in a network with large dynamic changes.

[0004] In another prior art, patent CN116346751A proposes a vehicle Ethernet switch control method, wherein the vehicle Ethernet switch is connected to the Ethernet controller through multiple first-type ports; the vehicle Ethernet switch is connected to the external device through a second-type port; the Ethernet controller sends an Ethernet message to the vehicle Ethernet switch through the first-type port; the vehicle Ethernet switch parses the target MAC address in the Ethernet message according to the Ethernet message, determines the port number of the first-type port corresponding to the MAC address according to the forwarding table, and forwards the Ethernet message to the port number; the port number includes all the numbers of the first-type ports; the external device sends the Ethernet message to the vehicle Ethernet switch through the second-type port; the vehicle Ethernet switch adds a VLAN tag to the Ethernet message and sends it to the first-type port. However, this solution increases the cost of vehicle Ethernet, and different port types require additional hardware equipment, and the cost of required training and maintenance equipment also increases accordingly. Summary of the invention

[0005] In the prior art, switches for in-vehicle Ethernet use VLANs to divide and manage services, but this has the problems of high cost and poor flexibility. In order to simplify configuration, reduce costs, reduce complexity and quickly deploy, when Ethernet services are relatively small, VLAN (virtual local area network) management ports are not used, but ports are directly identified and managed through physical ports (ports), and firewall settings are strengthened on this basis to compensate for potential risks.

[0006] To this end, the present invention proposes a switch port management method for an in-vehicle Ethernet network with less services, and the technical solution adopted is:

[0007] A switch port management method for an in-vehicle Ethernet, the method specifically comprising:

[0008] Determine an Ethernet topology; the Ethernet topology includes a main interactive domain controller with a switch and a small controller that interacts with the domain controller;

[0009] Assign MAC addresses to the main interactive domain controller and small controllers, and assign specific port numbers to the corresponding controllers according to the connection requirements of each controller;

[0010] Plan the IP address space and determine the IP address corresponding to each controller;

[0011] Strengthen the firewall settings for controllers that interact with the outside world and configure inbound and outbound rules.

[0012] The main interactive domain controller includes SOCs responsible for different services.

[0013] According to the above scheme, the Ethernet topology is determined as follows:

[0014] Determine the number of controllers connected to the switch and their SoC business requirements, and further determine the number of ports required for the switch.

[0015] According to the above solution, the MAC addresses of the main interactive domain controller and the small controller are allocated by the equipment manufacturer or the network administrator according to the needs.

[0016] According to the above scheme, the firewall settings are specifically as follows:

[0017] Only controllers involved in interacting with the outside world are allowed to access, and other devices are not allowed to access; and relevant interactive controllers are only allowed to access relevant business port numbers.

[0018] According to the above scheme, the inbound rules are specifically as follows:

[0019] Allow traffic from the IP address or MAC address of the interactive controller to pass, but only to the specified service port number;

[0020] Deny inbound traffic from all other IP addresses or MAC addresses, or restrict them to access only non-critical ports.

[0021] According to the above scheme, the outbound rules are specifically as follows:

[0022] Limit the controller to send data only to specific IP addresses or domain names, or limit the controller to communicate only using specific port numbers.

[0023] According to the above scheme, the port number corresponding to each controller is unique, and the IP address of each controller is unique in the network.

[0024] A computer storage medium stores a computer program executable by a processor, wherein the computer program executes the switch port management method of the vehicle-mounted Ethernet described in the above scheme.

[0025] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the switch port management method of the vehicle-mounted Ethernet described above when executing the computer program.

[0026] The beneficial effects produced by the present invention are:

[0027] 1. Port management is used to divide and isolate network traffic through physical ports, which simplifies network configuration, reduces the complexity of network architecture, makes network deployment faster and more efficient, and makes the network easier to understand and maintain.

[0028] 2. Port management has lower requirements on hardware and software, thus reducing costs.

[0029] 3. By strengthening the firewall settings, monitoring and filtering the data packets in and out of the network, potential security threats and malicious attacks can be prevented; by setting inbound and outbound rules, illegal access and unauthorized traffic transmission are restricted, the security of the network is improved, and the risk of not being able to provide fine-grained access control and traffic isolation is compensated. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 It is a schematic flow diagram of the method of the present invention;

[0031] Figure 2 is a schematic diagram of the Ethernet topology structure of this embodiment; Figure 3 It is a structural diagram of a computer device provided by another embodiment. DETAILED DESCRIPTION

[0032] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0033] Embodiment 1

[0034] like Figure 1 As shown, this embodiment provides a switch port management method for vehicle-mounted Ethernet, and the method steps specifically include:

[0035] S1. Determine the Ethernet topology.

[0036] The Ethernet topology includes a main interactive domain controller with a switch and a small controller that interacts with the main interactive domain controller. The main interactive domain controller includes SOCs responsible for different services. To determine the Ethernet topology, it is necessary to clarify the number of controllers that will be connected to the switch and their SOC service requirements, so as to further determine the number of ports required by the switch. The Ethernet topology determined in this embodiment is as follows: Figure 2 As shown, in this embodiment, the main interactive domain controller is provided with four SOCs, and four small controllers interacting with the main interactive domain controller are provided to further determine the number of ports required by the switch.

[0037] S2. Allocate MAC addresses to the main interactive domain controller and the small controllers, and assign specific port numbers to the corresponding controllers according to the connection requirements of each controller.

[0038] Each controller (such as ECU, sensor, etc.) should have a unique MAC address, which is usually assigned by the device manufacturer, but in some cases, it can also be assigned by the network administrator as needed. Each physical port on the switch has a unique port number, and a specific port number is assigned to the corresponding controller based on the connection requirements of the controller.

[0039] In this embodiment, the port number and MAC address of each controller are assigned as follows:

[0040]

[0041] S3. Plan the IP address space and determine the IP address corresponding to each controller.

[0042] Plan a suitable IP space according to the network scale and actual needs. Usually, IP address segments are allocated such as 192.168.xx or 10.xxx. It is necessary to ensure that the IP address of each controller is unique in the network.

[0043] In this embodiment, the IP address assigned to each controller is shown in the following table:

[0044]

[0045] S4. Strengthen the firewall settings for controllers that interact with the outside world and configure inbound and outbound rules.

[0046] The firewall of this embodiment is configured to allow only interactively related controllers to access, and other devices cannot access; and the relevant interactive controllers are only allowed to access the relevant service port numbers.

[0047] The inbound rules configured in this embodiment are:

[0048] 1. Allow traffic from the IP address or MAC address of the interactive controller to pass, but only to the specified business port number.

[0049] 2. Deny inbound traffic from all other IP addresses or MAC addresses, or restrict them to access only non-critical ports.

[0050] The outbound rules configured in this embodiment are:

[0051] Set outbound rules as needed to limit the data traffic sent by the controller to the outside. For example, you can limit the controller to send data only to a specific IP address or domain name, or limit it to communicate using a specific port number.

[0052] Embodiment 2

[0053] The present application also provides a computer-readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a disk, an optical disk, a server, an App application store, etc., on which a computer program is stored, and the program realizes corresponding functions when executed by a processor. The computer-readable storage medium of this embodiment is used for a switch port management device of an in-vehicle Ethernet, and when executed by a processor, a switch port management method of an in-vehicle Ethernet of a method embodiment is realized.

[0054] Embodiment 3

[0055] like Figure 3 The figure is a schematic diagram of the structure of a computer device provided by an embodiment of the present invention, such as a smart phone, tablet computer, laptop computer, desktop computer, rack server, blade server, tower server or cabinet server (including an independent server, or a server cluster composed of multiple servers) that can execute programs. The computer device 20 of this embodiment includes at least but is not limited to: a memory 21 and a processor 22 that can communicate with each other via a system bus, such as Figure 3 It should be pointed out that Figure 3 Only computer device 20 is shown with components 21 - 22 , but it should be understood that implementing all of the components shown is not a requirement, and more or fewer components may alternatively be implemented.

[0056] In this embodiment, the memory 21 (i.e., readable storage medium) includes flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM). The memory 21 may also be an external storage device of the computer device 20, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 20. Of course, the memory 21 may also include both the internal storage unit of the computer device 20 and its external storage device. In this embodiment, the memory 21 is generally used to store the operating system and various application software installed on the computer device 20, such as the program code of the visual recognition device for disordered sorting of cylindrical bars in the method embodiment. In addition, the memory 21 may also be used to temporarily store various data that have been output or are to be output.

[0057] In some embodiments, the processor 22 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips. The processor 22 is generally used to control the overall operation of the computer device 20. In this embodiment, the processor 22 is used to run the program code stored in the memory 21 or process data, such as a switch port management device of an in-vehicle Ethernet, to implement the switch port management method of the in-vehicle Ethernet in the method embodiment.

[0058] The above embodiment adopts port management to divide and isolate network traffic through physical ports, avoiding complex VLAN configuration and routing settings. Although VLAN division provides flexible network division and isolation capabilities, it also increases the complexity and management difficulty of the network. Port management divides the network through simple physical connections, reducing the complexity of the network architecture, simplifying the configuration, making the network configuration more intuitive and simple, reducing the difficulty and error rate of configuration, and making the network easier to understand and maintain; compared with VLAN division, port management has lower requirements in hardware and software. Port management does not require additional VLAN support equipment or software licenses, thereby saving equipment procurement and licensing costs. At the same time, due to simplified configuration, the cost of network maintenance and professional training is also reduced; at the same time, when the network needs to be deployed quickly, port management provides faster configuration and connection speed. It does not require complex VLAN configuration and routing settings, and only requires simple connection of physical ports to achieve network connectivity, which makes network deployment faster and more efficient.

[0059] Although port management simplifies configuration and reduces costs, it may not provide fine-grained access control and traffic isolation like VLAN division. Therefore, in order to compensate for this risk, the embodiment also makes specific settings for strengthening the firewall. The firewall can monitor and filter data packets in and out of the network to prevent potential security threats and malicious attacks. At the same time, it can also provide logging and alarm functions to help network administrators discover and handle security incidents in a timely manner. By configuring strict firewall rules, illegal access and unauthorized traffic transmission can be restricted, thereby improving the security of the network.

[0060] In another preferred embodiment of the present invention, in addition to strengthening the firewall settings, other security measures can be combined to further improve the security of the network. For example, port security features are implemented to limit the access of illegal devices; encryption technology is used to protect the transmission of sensitive data; and network vulnerability scanning and penetration testing are performed regularly to discover and repair potential security issues.

[0061] The order of execution of each step in the above embodiment does not mean the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0062] It should be understood that those skilled in the art can make improvements or changes based on the above description, and all these improvements and changes should fall within the scope of protection of the appended claims of the present invention.

Claims

1. A switch port management method for vehicle-mounted Ethernet, characterized in that: The method is specifically as follows: Determine an Ethernet topology; the Ethernet topology includes a main interactive domain controller with a switch and a small controller interacting with the main interactive domain controller; Assign MAC addresses to the main interactive domain controller and small controllers, and assign specific port numbers to the corresponding controllers according to the connection requirements of each controller; Plan the IP address space and determine the IP address corresponding to each controller; Strengthen the firewall settings for controllers that interact with the outside world and configure inbound and outbound rules.

2. A switch port management method for vehicle-mounted Ethernet according to claim 1, characterized in that: The main interactive domain controller includes SOCs responsible for different services.

3. A switch port management method for vehicle-mounted Ethernet according to claim 1 or claim 2, characterized in that: Determining the Ethernet topology specifically includes: Determine the number of controllers connected to the switch and their SoC business requirements, and further determine the number of ports required for the switch.

4. A switch port management method for vehicle-mounted Ethernet according to claim 1, characterized in that: The allocation of MAC addresses to the main interactive domain controller and the small controller is specifically allocated by the device manufacturer or the network administrator according to needs.

5. The switch port management method of vehicle-mounted Ethernet according to claim 1, characterized in that: The firewall settings are specifically as follows: Only controllers involved in interacting with the outside world are allowed to access, and other devices are not allowed to access; and relevant interactive controllers are only allowed to access relevant business port numbers.

6. A switch port management method for vehicle-mounted Ethernet according to claim 1, characterized in that: The inbound rules are specifically: Allow traffic from the IP address or MAC address of the interacting controller to pass, but only on the specified port number; Deny inbound traffic from all other IP addresses or MAC addresses, or restrict them to access only non-critical ports.

7. A switch port management method for vehicle-mounted Ethernet according to claim 1, characterized in that: The outbound rules are as follows: Limit the controller to send data only to specific IP addresses or domain names, or limit the controller to communicate only using specific port numbers.

8. The switch port management method of vehicle-mounted Ethernet according to claim 1, characterized in that: The port number corresponding to each controller is unique, and the IP address of each controller is unique in the network.

9. A computer storage medium, characterized in that: A computer program executable by a processor is stored therein, and the computer program executes the switch port management method of the vehicle-mounted Ethernet as described in any one of claims 1 to 8.

10. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the switch port management method of the vehicle-mounted Ethernet according to any one of claims 1 to 8 is implemented.

Images