Signal isolation routing equipment and private network isolation transmission equipment
By using signal isolation routing equipment and private network isolation transmission equipment, and by utilizing independent network modules and physical isolation measures, the problem of smart TVs being able to connect to both the Internet and private networks simultaneously has been solved, achieving secure data isolation and transmission.
Patent Information
- Application Number
- CN202511083821.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-04
- Publication Date
- 2025-11-18
AI Technical Summary
Existing smart TVs cannot connect to both the internet and private networks simultaneously, making them unsuitable for situations requiring simultaneous access to both networks.
Signal isolation routing equipment and private network isolation transmission equipment are used to transmit Internet and private network data through the first network module and the second network module respectively. Data isolation between the Internet and the private network is achieved by using independent media access control addresses and physical isolation measures.
It enables televisions to simultaneously acquire data from the internet and private networks, avoiding the risk of private network data leakage and ensuring the security and isolation of data transmission.
Smart Images
Figure CN120980277A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application relates to the technical field of data transmission, and in particular to a signal isolation routing device and a private network isolation transmission device. BACKGROUND
[0002] The existing smart TV usually has the function of connecting wireless network and wired network at the same time, but in actual operation, only one network is generally effective at the same time even if the wireless network and the wired network are connected at the same time. In this case, the situation of needing to connect two networks at the same time is difficult to be met, for example, the situation of needing to connect the TV to the Internet and the private network at the same time is usually difficult to be met. SUMMARY
[0003] The signal isolation routing device and the private network isolation transmission device provided by the present application can effectively isolate the data transmission of the Internet and the private network.
[0004] In a first aspect, the present application provides a signal isolation routing device, comprising:
[0005] A first network module, which establishes a communication connection with an interconnection interface of an optical modem through a point-to-point manner, and is configured to establish a first link of wireless network communication with a TV through a wireless network;
[0006] A second network module, which establishes a communication connection with a private network interface of the optical modem through a bridging manner, and is configured to establish a second link of wireless network communication with a private network isolation transmission device through a wireless network, so that the private network isolation transmission device receives and decrypts private network data sent by the second network module, and transmits the private network data to the TV through a USB interface.
[0007] Optionally, the first network module and the second network module have independent media access control addresses respectively.
[0008] Optionally, the wiring interval between the wiring of the printed circuit board corresponding to the first network module and the wiring of the printed circuit board corresponding to the second network module is not less than 2 millimeters.
[0009] Optionally, the first network module is configured to determine encryption parameters in a link control protocol negotiation phase when the TV requests to establish wireless network communication; and the second network module is configured to verify identity information of the private network isolation transmission device through a custom field in a dynamic host configuration protocol request when the private network isolation transmission device requests to establish wireless network communication, so that the first link and the second link form protocol layer isolation.
[0010] Optionally, the first network module is configured to receive a transmission control protocol heartbeat packet sent by the television, and the second network module is configured to receive a user datagram protocol heartbeat packet sent by the special network isolation transmission device, so that the first link and the second link achieve physical port isolation.
[0011] In a second aspect, the present application provides a special network isolation transmission device, comprising:
[0012] a network connection module configured to establish a second link for wireless network communication with the second network module in the signal isolation routing device according to any one of the preceding aspects;
[0013] a data conversion module in communication connection with the network connection module, configured to encapsulate special network data received by the network connection module into USB protocol data;
[0014] a USB transmission module in communication connection with the data conversion module, configured to transmit the USB protocol data to the television.
[0015] Optionally, the data conversion module is configured to encapsulate the special network data into a preset fixed length and a preset descriptor type, and set a check code in the header of the USB data packet and a timestamp in the tail of the USB data packet.
[0016] Optionally, the USB transmission module is configured to respond to an authentication request sent by the television, obtain authentication information, and send the authentication information to the television.
[0017] Optionally, the network connection module is configured to respond to an instruction of the television to obtain a special network, send an encrypted request to obtain the special network to the signal isolation routing device through a preset mode, and receive network parameters returned by the signal isolation routing device.
[0018] Optionally, a connection port of the USB transmission module is exclusively occupied by a special network application of the television, so that the special network application of the television sends read-write network data instructions to the USB transmission module.
[0019] In the technical solution provided by the present application, the special network data is transmitted to the television through the USB, and the internet data is transmitted to the television through the wireless network, so that the television can simultaneously obtain the internet data and the special network data. Moreover, the internet data is transmitted through the first network module, and the special network data is transmitted through the second network module, so that the internet data and the special network data are effectively isolated, and the risk of leakage of the special network data is avoided. BRIEF DESCRIPTION OF DRAWINGS
[0020] Figure 1A use scene diagram of the signal isolation routing device and the private network isolation transmission device in an embodiment of the present application. DETAILED DESCRIPTION
[0021] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.
[0022] The embodiments of the present application provide a signal isolation routing device, as shown in the accompanying drawings, comprising: Figure 1
[0023] A first network module, which establishes a communication connection with an interconnection interface of an optical modem in a point-to-point manner, is configured to establish a first link of wireless network communication with a television through a wireless network.
[0024] A second network module, which establishes a communication connection with a private network interface of the optical modem in a bridging manner, is configured to establish a second link of wireless network communication with a private network isolation transmission device through a wireless network, so that the private network isolation transmission device receives and decrypts private network data sent by the second network module and transmits the private network data to the television through a USB interface.
[0025] In some embodiments, when the signal isolation routing device in the present embodiment is used, a dual-WiFi network with both a private network and the Internet needs to be built first. The signal isolation routing device is connected to an optical network unit (ONU) in a user's home, the optical network unit (ONU) is connected to an optical fiber carrying signals of the private network and the Internet, and the optical network unit (ONU) separates the signals of the private network and the Internet through VLAN. The second network module of the signal isolation routing device sets the access mode of the private network link to a bridging mode and binds one WiFi signal to a bridging network port. The first network module sets the access of the Internet link to a point-to-point (PPPOE) mode and binds another WiFi signal to a PPPOE network port.
[0026] In the technical solutions provided by the embodiments of the present application, the private network data is transmitted to the television through a USB, and the Internet data is transmitted to the television through a wireless network, so that the television can obtain the private network data and the Internet data at the same time. In addition, the private network data is transmitted by the second network module, and the Internet data is transmitted by the first network module, so that the private network data and the Internet data are effectively isolated, and the risk of leakage of the private network data is avoided.
[0027] As an optional implementation, the first network module and the second network module have independent media access control addresses respectively.
[0028] In some embodiments, the first network module and the second network module respectively use chips with independent MAC addresses.
[0029] As an optional implementation, the wiring interval between the wirings of the printed circuit board corresponding to the first network module and the wirings of the printed circuit board corresponding to the second network module is not less than 2 mm.
[0030] In some embodiments, the wiring interval between the wirings of the printed circuit board corresponding to the first network module and the wirings of the printed circuit board corresponding to the second network module is not less than 2 mm, so as to realize physical isolation of the wiring mode of the printed circuit board, and the buses of the first network module and the second network module are not shared. When the optical modem is configured with VLAN, the private network VLAN ID may be set as 4094 (custom high segment ID) and the internet VLAN ID may be set as 100, and the traffic monitoring is realized through the switch port mirroring function.
[0031] As an optional implementation, the first network module is configured to determine the encryption parameter in the link control protocol negotiation stage when the television requests to establish wireless network communication, and the second network module is configured to verify the identity information of the private network isolation transmission device through a custom field in the dynamic host configuration protocol request when the private network isolation transmission device requests to establish wireless network communication, so as to form protocol layer isolation of the first link and the second link.
[0032] In some embodiments, the private network isolation transmission device may add a custom Option field (such as Option 128 = 0x5A) in the private network DHCP request sent when connecting the second network module, and the server identifies the private network device through the field; when the television connects the first network module, the internet link uses PPPOE dialing, and MPPE (Microsoft Point-to-Point Encryption) encryption (key length 128 bits) is negotiated in the LCP stage, so as to form protocol layer isolation with the private network link.
[0033] As an optional implementation, the first network module is configured to receive the transmission control protocol heartbeat packet sent by the television, and the second network module is configured to receive the user datagram protocol heartbeat packet sent by the private network isolation transmission device, so as to realize physical port isolation of the first link and the second link.
[0034] In some embodiments, in order to realize the isolation of the physical port, a dual-frequency heartbeat packet structure can be adopted, a private network heartbeat packet adopts a user datagram protocol heartbeat packet, UDP protocol (port 9999), the payload contains a 128-bit random number and a device state code; an Internet heartbeat packet adopts a transmission control protocol heartbeat packet, that is, a TCP protocol (port 8080), and is transmitted through an HTTP long polling mode; so as to realize the physical port isolation of the private network and the Internet.
[0035] The embodiment of the application further provides a private network isolation transmission device, as shown in the accompanying drawings, comprising: Figure 1
[0036] A network connection module, which is used for establishing a second link of wireless network communication with the second network module in the signal isolation routing device.
[0037] A data conversion module, which is in communication connection with the network connection module, and is used for encapsulating the private network data received by the network connection module into USB protocol data.
[0038] A USB transmission module, which is in communication connection with the data conversion module, and is used for transmitting the USB protocol data to the television set.
[0039] In some embodiments, when the private network isolation transmission device is in use, the device will automatically detect the state of the WiFi (that is, the network connection module) and the USB interface (that is, the USB transmission module) after being started, to ensure that they work normally. This step is to ensure that the communication interface of the device can be normally used, and lays a foundation for subsequent data transmission. After the detection is completed, the network connection module will establish a connection with the private network according to the preset private network configuration information, and perform network authentication and authorization. Through the preset configuration information and the strict authentication and authorization mechanism, it is ensured that the device can safely access the private network. The USB transmission module should be connected with the USB interface of the television set, and the USB transmission module will automatically identify the television set and establish a data transmission channel. The connection of the USB interface is convenient and fast, and the automatic identification of the device to the television set can ensure the correct establishment of the data transmission channel.
[0040] As an optional implementation, the data conversion module is used for encapsulating the private network data with a preset fixed length and a preset descriptor type, setting a check code in the head of the USB data packet, and setting a time stamp in the tail of the USB data packet.
[0041] In some embodiments, during the use of the private network isolation transmission device, private network signal data is received from the private network, and the private network data is encapsulated as a USB protocol data packet. During encapsulation, a custom transmission protocol can be used, for example, with a bLength of 64 bytes of fixed length, a bDescriptorType of 34 of a custom descriptor type; a 16-byte CRC-16-CCITT check code is added to the header, and the specific algorithm parameters of the check code can be, for example: generating polynomial G(x) = x 16 +x 12 +x 5 +1, initial value 0xFFFF, no flip input / output bit during calculation, and the final check value is embedded in the packet header after being XORed with 0xFFFF; and an 8-byte Unix timestamp (accurate to milliseconds) is appended to the tail for data timing verification. The 8-byte timestamp appended to the tail ensures the correctness of the data timing. After data processing and conversion inside the private network isolation transmission device, the USB protocol data packet is transmitted to the television through the USB interface.
[0042] As an optional implementation, the USB transmission module is configured to obtain authentication information and send it to the television in response to an authentication request sent by the television.
[0043] In some embodiments, after detecting the private network isolation transmission device, the television initializes the private network isolation transmission device and loads the private network SDK / APP corresponding to the private network isolation transmission device. The private network SDK / APP needs to be authenticated with the private network isolation transmission device, and the authentication method can be, for example, based on the public and private keys and elliptic curve operations in GB / T32918.3-2016 to perform security verification on the device.
[0044] As an optional implementation, the network connection module is configured to send an encrypted request to obtain the private network to the signal isolation routing device through a preset mode in response to an instruction of the television to obtain the private network, and receive network parameters returned by the signal isolation routing device.
[0045] In some embodiments, after the television verifies the private network isolation transmission device, the private network SDK / APP sends an instruction to obtain the private network to the private network isolation transmission device. The private network isolation transmission device sends an encrypted request containing the device fingerprint (for example, it can use the CPU serial number + MAC address hash value) to the second network module based on the dynamic IP allocation protocol of the elliptic curve encryption (ECC-SM2 algorithm) through the mode of adding OPTION60 and OPTION82 specified by the private network. The second network module returns an IP address with a timestamp (the validity period can be, for example, 900 seconds).
[0046] As an optional implementation, the connection port of the USB transmission module is monopolized by the private network application of the television, so that the private network application of the television sends read-write network data instructions to the USB transmission module.
[0047] In some embodiments, when the private network SDK / APP sends read-write network data instructions to the private network isolation transmission device as an application monopolizing the connection port of the private network isolation transmission device, the television does not manage it as an independent network card, so that the television can provide an Internet access channel for the Internet service APP while maintaining an Internet access environment. The private network SDK / APP realizes an end-to-end private network data link through the private network isolation transmission device.
[0048] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto, any person skilled in the art can easily think of changes or replacements within the technical range disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.
Claims
1. A signal isolation routing device, characterized in that, include: The first network module establishes a communication connection with the optical modem via a point-to-point interface. The first network module is used to establish a first link for wireless network communication with the television via a wireless network. The second network module establishes a communication connection with the optical modem's private network interface through bridging. The second network module is used to establish a second link for wireless network communication with the private network isolation transmission device through a wireless network, so that the private network isolation transmission device can receive and decrypt the private network data sent by the second network module and transmit it to the television through the USB interface.
2. The signal isolation routing device according to claim 1, characterized in that, The first network module and the second network module each have independent media access control addresses.
3. The signal isolation routing device according to claim 1, characterized in that, The wiring spacing between the printed circuit board corresponding to the first network module and the printed circuit board corresponding to the second network module is not less than 2 mm.
4. The signal isolation routing device according to claim 1, characterized in that, The first network module is used to determine encryption parameters during the link control protocol negotiation phase when the television requests to establish wireless network communication; the second network module is used to verify the identity information of the private network isolation transmission device through a custom field in the dynamic host configuration protocol request when the private network isolation transmission device requests to establish wireless network communication, so as to enable the first link and the second link to form protocol layer isolation.
5. The signal isolation routing device according to claim 1, characterized in that, The first network module is used to receive Transmission Control Protocol (TCP) heartbeat packets sent by the television set, and the second network module is used to receive User Datagram Protocol (UDP) heartbeat packets sent by the private network isolation transmission equipment, so as to achieve physical port isolation between the first link and the second link.
6. A private network isolation transmission device, characterized in that, include: A network connection module, wherein the network connection module is used to establish a second link for wireless network communication with the second network module in the signal isolation routing device according to any one of claims 1-5; A data conversion module is communicatively connected to the network connection module, and the data conversion module is used to encapsulate the private network data received by the network connection module into USB protocol data; The USB transmission module is communicatively connected to the data conversion module and is used to transmit the USB protocol data to the television.
7. The private network isolation transmission device according to claim 6, characterized in that, The data conversion module is used to encapsulate the private network data with a preset fixed length and a preset descriptor type, and to set a checksum at the header of the USB data packet and a timestamp at the tail of the USB data packet.
8. The private network isolation transmission device according to claim 6, characterized in that, The USB transmission module is used to respond to the authentication request sent by the TV, obtain authentication information, and send it to the TV.
9. The private network isolation transmission device according to claim 6, characterized in that, The network connection module is used to respond to the instruction of the TV to obtain the private network, send an encrypted request to the signal isolation routing device to obtain the private network through a preset mode, and receive the network parameters returned by the signal isolation routing device.
10. The private network isolation transmission device according to claim 6, characterized in that, The connection port of the USB transmission module is exclusively used by the TV's private network application, so that the TV's private network application can send read and write network data commands to the USB transmission module.