Coding and decoding card and coding and decoding equipment

Abstract

The embodiment of the utility model relates to a coding and decoding card and coding and decoding equipment. The coding and decoding card comprises a system interface which comprises a first connecting end and a second connecting end; wherein the first connecting end is connected with the host through a system bus; the codec is respectively connected with the second connecting ends; the encryption chip comprises a screening module, an encryption module and a decryption module; wherein one end of the screening module is connected with the encoder through an internal bus, the other end of the screening module is connected with the encryption module, and the decryption module is connected with the decoder through an internal bus; the network interface is connected with the encryption chip and comprises a third connecting end and a fourth connecting end; wherein the third connecting end is respectively connected with the encryption module and the decryption module, and the fourth connecting end is connected with external equipment. According to the invention, network isolation can be realized, the security of the coding and decoding card is improved, and network attacks are effectively prevented.

Description

Technical Field

[0001] The embodiments of the present application relate to the technical field of codec devices, and in particular, to a codec card and a codec device. Background Art

[0002] When using a codec card, it is usually directly plugged into the host computer in a wired manner for use, and it has no other special functions. After processing the data inside the codec card, the data needs to be sent out, but the data is still sent to the outside through the host network. This method of sending data through the host network makes the security of the codec card completely dependent on the host itself. Therefore, when the host network is attacked from the outside, the security of the codec card cannot be guaranteed.

[0003] Therefore, there is an urgent need to design a codec card with high security.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Utility Model Content

[0005] The purpose of the embodiments of the present application is to provide a codec card and a codec device, thereby overcoming one or more problems caused by the limitations and defects of the related art at least to a certain extent.

[0006] According to a first aspect of an embodiment of the present application, a codec card is provided, including:

[0007] The system interface comprises a first connection terminal and a second connection terminal; wherein the first connection terminal is connected to the host via a system bus;

[0008] an encoder and a decoder, connected to the second connection end respectively;

[0009] An encryption chip, comprising a screening module, an encryption module and a decryption module; wherein one end of the screening module is connected to the encoder via an internal bus, the other end of the screening module is connected to the encryption module, and the decryption module is connected to the decoder via an internal bus;

[0010] A network interface is connected to the encryption chip, and includes a third connection terminal and a fourth connection terminal; wherein the third connection terminal is respectively connected to the encryption module and the decryption module, and the fourth connection terminal is connected to an external device.

[0011] In one embodiment of the present application, the system bus includes a PCIe bus or an ISA bus.

[0012] In one embodiment of the present application, the internal bus includes an I2C bus, an SPI bus or an SCI bus.

[0013] In one embodiment of the present application, the encryption chip further includes:

[0014] A verification module is connected in series between the decryption module and the third connection end of the network interface.

[0015] In one embodiment of the present application, the network interface is RJ45 or optical fiber.

[0016] In one embodiment of the present application, the encryption chip is a national secret algorithm encryption chip.

[0017] According to a second aspect of the embodiments of the present application, a codec device is provided, including the codec card in the above embodiment.

[0018] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0019] In the embodiment of the present application, the network of the codec card is isolated from the network of the host through the network interface through the above codec card, so that the network on the codec card and the network on the host are independent of each other, achieving the effect of network isolation, thereby improving the security of the codec card. In addition, the setting of the encryption chip further isolates the encoder and decoder on the codec card from external devices, making the codec card safer and effectively preventing network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present application, and together with the specification are used to explain the principles of the present application. Obviously, the drawings described below are only some embodiments of the present application, and for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0021] Figure 1 A schematic diagram showing the structure of a codec card in an exemplary embodiment of the present application is shown;

[0022] Figure 2 A schematic diagram showing the structure of a codec card when the encryption chip further includes a verification module in an exemplary embodiment of the present application.

[0023] In the figure: 100, codec card; 110, system interface; 120, encoder; 130, decoder; 140, encryption chip; 141, screening module; 142, encryption module; 143, decryption module; 144, verification module; 150, network interface; 160, system bus; 170, internal bus. DETAILED DESCRIPTION

[0024] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that this application will be more comprehensive and complete and fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0025] In addition, the accompanying drawings are only schematic illustrations of the embodiments of the present application and are not necessarily drawn to scale. The same reference numerals in the drawings represent the same or similar parts, and their repeated descriptions will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities.

[0026] When the existing codec card is in use, it sends data to the external device through the host network. When the host network is attacked from the outside, the security of the codec card cannot be guaranteed.

[0027] Based on this, this example implementation first provides a codec card. Figure 1 As shown in , the codec card may include: a system interface 110, an encoder 120, a decoder 130 and a network interface 150. The system interface 110 includes a first connection end and a second connection end, and the first connection end is connected to the host through a system bus 160; the encoder 120 and the decoder 130 are respectively connected to the second connection end; the encryption chip 140 includes a screening module 141, an encryption module 142 and a decryption module 143; wherein one end of the screening module 141 is connected to the encoder 120 through an internal bus 170, the other end of the screening module 141 is connected to the encryption module 142, and the decryption module 143 is connected to the decoder 130 through the internal bus 170; the network interface 150 includes a third connection end and a fourth connection end; wherein the third connection end is respectively connected to the encryption module 142 and the decryption module 143, and the fourth connection end is connected to an external device.

[0028] It should be understood that the first connection end of the system interface 110 is connected to the host through the system bus 160, and the codec 130 of the system interface 110 is connected to the second connection end. That is, the codec 130 is plugged into the host through the system interface 110 in the form of the system bus 160 to achieve communication between the codec 130 and the host so as to transmit data therebetween. The system bus 160 can be a PCIe bus or an ISA bus. The specific selection can be made according to the actual situation, and this application does not limit this.

[0029] In order to isolate the network on the codec card 100 from the network on the host to improve the security of the codec card 100, the present application sets a network interface 150, which isolates the network of the codec card 100 from the network on the host to achieve mutual independence between the network on the codec card 100 and the network on the host. In order to further improve the security of the codec card 100, the present application also sets an encryption chip 140. The encryption chip 140 further isolates the encoder 120 and the decoder 130 on the codec card 100 from external devices, making the codec card 100 more secure and effectively preventing network attacks.

[0030] In the process of using the codec card 100 of the present application, after the codec card 100 and the host are connected through the system interface 110 and the system bus 160, the codec card 100 and the host can perform data transmission through the system interface 110 and the system bus 160. When it is necessary to obtain host data from the host, the host data is transmitted to the system interface 110 through the system bus 160, and then transmitted to the encoder 120 through the system interface 110, and the encoder 120 encodes the host data to obtain the encoded data. Since the encoder 120 and the screening module 141 are connected through the internal bus 170, the encoder 120 sends the encoded data to the screening module 141 through the internal bus 170. After the screening module 141 receives the encoded data, the screening module 141 processes the encoded data, and then processes it through the encryption module 142. The specific processing method includes: the screening module 141 mainly screens the encoded data that meets the security requirements, and encrypts the encoded data that meets the security requirements through the encryption module 142 to obtain the encrypted data, and finally sends the encrypted data to the external device through the network interface 150. The present application sets a network interface 150 on the codec card 100, which can realize the independence of the network on the codec card 100 and the network of the host, and achieve the network isolation effect. Furthermore, the encryption chip 140 further isolates the codec card 100 from the outside, making the codec card 100 safer, and can effectively prevent network attacks, ensuring the security of the codec card 100 and the host data. Among them, the internal bus 170 can be an I2C bus, an SPI bus or an SCI bus, etc. It can be selected according to the actual situation, and the present application does not limit this.

[0031] It should be noted that the codec card 100 in the present application is a codec host card, and the host card has high security. Using the host card can further improve the security of the codec card 100.

[0032] It should be noted that after receiving the encoded data, the screening module 141 needs to screen out data that meets the security requirements from the encoded data, and then encrypt the encoded data that meets the security requirements through the encryption module 142 to obtain encrypted data, and then send the encrypted data out through the network interface 150.

[0033] It should be noted that the screening module 141 for screening out data meeting security requirements from the coded data is implemented using existing functional modules, and the screening method used therein is also existing technology.

[0034] The functional principle of the encryption chip 140 is as follows:

[0035] 1. Access control. The screening module 141 uses the access control mechanism to restrict only authorized users or authorized devices to use the codec card 100 and access the internal data of the host through the codec card 100. This can be achieved through passwords, biometrics, smart cards, etc.

[0036] 2. Audit log records. All network data transmission activities are recorded, including user access, data transmission and system operation, so as to track and investigate potential security incidents. If it is an illegal access, the internal authentication server can identify such behavior and issue an alarm or other actions; here, the screening module 141 is equivalent to the collection of behavioral features, and the real authentication is completed by the relevant authentication server in the user's internal network. These data are not sent out through the network and are completely transparent to users. This can effectively prevent internal attacks.

[0037] 3. Traffic monitoring and analysis. The filtering module 141 has built-in traffic monitoring tools and network analysis tools to monitor network traffic and identify abnormal activities and potential security threats in a timely manner.

[0038] 4. Data obfuscation and encrypted transmission. The screening module 141 obfuscates the data. Smaller traffic coded data can be added with some obfuscated data, which can effectively deal with external traffic analysis attacks. In addition, the encryption module 142 encrypts the coded data that meets the security requirements to ensure that the encrypted data is not stolen or tampered with during transmission.

[0039] 5. Data integrity protection: Use data integrity verification technology, such as hash functions or message authentication codes (MACs), to ensure that encrypted data has not been tampered with during transmission.

[0040] Not limited to the above actions, the encryption chip 140 can be expanded as needed to achieve different levels of security protection. The process of the encryption module 142 encrypting the screened data that meets the security requirements can be understood by referring to the prior art, and this application will not elaborate on this.

[0041] In the embodiment of the present application, through the above-mentioned codec card 100, the network of the codec card 100 is isolated from the network of the host through the network interface 150, so that the network on the codec card 100 and the network on the host are independent of each other, achieving the effect of network isolation, thereby improving the security of the codec card 100. In addition, the setting of the encryption chip 140 further isolates the codec card 100 from the external device, making the codec card 100 more secure and effectively preventing network attacks.

[0042] Next, we will refer to Figure 1 to Figure 2 The various components of the above-described codec card 100 in this exemplary embodiment are described in more detail.

[0043] In one embodiment, system bus 160 includes a PCIe bus or an ISA bus.

[0044] In one embodiment, the internal bus 170 includes an I2C bus, an SPI bus, or an SCI bus.

[0045] In one embodiment, the encryption chip 140 further includes:

[0046] The verification module 144 is serially connected between the decryption module 143 and the third connection terminal of the network interface 150 .

[0047] It should be understood that, in the process of using the codec card 100, the present application, because the external device is connected to the fourth connection end of the network interface 150, and the third connection end of the network interface 150 is connected to the verification module 144, therefore, the network data can be obtained from the external device through the network interface 150, and then the network data is sent to the verification module 144, the verification module 144 will perform a security check on the network data, screen out the network data that meets the security requirements, and then send the network data that meets the security requirements to the decryption module 143, the network data that meets the security requirements is decrypted by the decryption module 143 to obtain the decrypted data, and then transmitted to the decoder 130 through the internal bus 170, after receiving the decrypted data, the decoder 130 decodes it to obtain the decoded data, and finally sends the decoded data to the host through the system interface 110 and the system bus 160.

[0048] It should be noted that the data verification processing of the verification module 144 can be understood by referring to the prior art, and this application will not elaborate on this. The decryption processing of the data by the decryption module 143 can be understood by referring to the prior art, and this application will not elaborate on this.

[0049] In one embodiment, the system interface 110 is a PCIe interface or an ISA interface.

[0050] In one embodiment, the network interface 150 is RJ45 or optical fiber.

[0051] In one embodiment, the encryption chip 140 is a national secret algorithm encryption chip 140 .

[0052] It should be understood that the use of the national secret algorithm encryption chip 140 makes the encryption card have better encryption and decryption performance, and its internal algorithms include SM1 to SM9, which can be selected according to actual conditions. Its internal algorithm is a prior art, and this application will not elaborate on it.

[0053] This exemplary implementation also provides a codec device, including the codec card 100 in the above embodiment.

[0054] It should be understood that the terms "center", "longitudinal", "lateral", "length", "width", "thickness", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", "clockwise", "counterclockwise" and the like in the above description indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the embodiments of the present application and simplifying the description, and do not indicate or imply that the referred device or element must have a specific orientation, be constructed and operated in a specific orientation, and therefore should not be understood as a limitation on the embodiments of the present application.

[0055] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of the present application, the meaning of "multiple" is two or more, unless otherwise clearly and specifically defined.

[0056] In the embodiments of the present application, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to the specific circumstances.

[0057] In the embodiments of the present application, unless otherwise clearly specified and limited, the first feature being "above" or "below" the second feature may include the first and second features being in direct contact, or may include the first and second features not being in direct contact but being in contact through another feature between them. Moreover, the first feature being "above", "above" and "above" the second feature includes the first feature being directly above and obliquely above the second feature, or simply indicates that the first feature is higher in level than the second feature. The first feature being "below", "below" and "below" the second feature includes the first feature being directly below and obliquely below the second feature, or simply indicates that the first feature is lower in level than the second feature.

[0058] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example" or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification.

[0059] Those skilled in the art will readily come up with other embodiments of the present application after considering the specification and practicing the utility model disclosed herein. The present application is intended to cover any variations, uses or adaptations of the present application, which follow the general principles of the present application and include common knowledge or customary technical means in the art that are not disclosed in the present application.

Claims

1. A codec card, characterized in that: include: The system interface comprises a first connection terminal and a second connection terminal; wherein the first connection terminal is connected to the host via a system bus; an encoder and a decoder, connected to the second connection end respectively; An encryption chip, comprising a screening module, an encryption module and a decryption module; wherein one end of the screening module is connected to the encoder via an internal bus, the other end of the screening module is connected to the encryption module, and the decryption module is connected to the decoder via an internal bus; The network interface comprises a third connection terminal and a fourth connection terminal; wherein the third connection terminal is connected to the encryption module and the decryption module respectively, and the fourth connection terminal is connected to an external device.

2. The codec card according to claim 1, characterized in that: The system bus includes a PCIe bus or an ISA bus.

3. The codec card according to claim 1, characterized in that: The internal bus includes an I2C bus, an SPI bus or an SCI bus.

4. The codec card according to claim 1, characterized in that: The encryption chip also includes: A verification module is connected in series between the decryption module and the third connection end of the network interface.

5. The codec card according to claim 1, characterized in that: The system interface is a PCIe interface or an ISA interface.

6. The codec card according to claim 1, characterized in that: The network interface is RJ45 or optical fiber.

7. The codec card according to claim 1, characterized in that: The encryption chip is a national secret algorithm encryption chip.

8. A coding and decoding device, characterized in that: A codec card comprising any one of claims 1 to 7.

Images