Intranet and extranet isolated master control panel and embedded rack system
By implementing a hardware-level internal and external network isolation design, and utilizing a three-port switching chip and a main control panel with multiple communication ports, the problem of relying on network management experience for internal and external network isolation is solved, achieving efficient and secure data transmission and isolation effects.
Patent Information
- Application Number
- CN202520259727.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Utility models(China)
- Current Assignee / Owner
- Filing Date
- 2025-02-18
- Publication Date
- 2025-11-21
- Estimated Expiration
- 2035-02-18
AI Technical Summary
The effectiveness of isolation between internal and external networks in existing technologies depends on the technical skills and management experience of network administrators, which poses a risk to data security.
The main control board, which adopts internal and external network isolation, includes a first switching chip and a second switching chip. It achieves internal and external network isolation at the hardware level. The embedded rack system's network is divided into internal and external networks using a three-port switching chip and multiple communication ports, reducing operating costs and improving data security.
It achieves reliable isolation between internal and external networks, reduces operating costs, improves data security, and is less susceptible to the influence of network administrators' technical skills and management experience.
Smart Images
Figure CN223584201U_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The utility model relates to the technical field of ethernet communication, in particular to a main control disc and embedded rack system of internal and external network isolation. BACKGROUND
[0002] At present, the equipment in the general rack system is usually through RS-232 and RS-486 etc. to carry out networking communication, and the speed of the network is often not high. With the development of network technology, the speed and reliability of Ethernet have been greatly improved, and it has become the most widely used network. At the same time, various embedded rack systems are also developing, and more and more embedded control devices have Ethernet access function.
[0003] However, in order to protect the safety of data, the existing virtual local area network (Virtual Local Area Network, abbreviated as VLAN) technology can realize the isolation of internal and external network, and ensure the safety of data to a certain extent, but its isolation effect depends on the technical level and management experience of network management personnel, which will make the data security still exist certain security risks.
[0004] Therefore, overcoming the defects of the prior art is an urgent problem to be solved in the technical field. CONTENT OF THE UTILITY MODEL
[0005] The technical problem to be solved by the utility model is how to solve the problem that the isolation effect of internal and external network in the prior art depends on the technical level and management experience of network management personnel, and the data security exists certain security risks.
[0006] The utility model adopts the following technical scheme:
[0007] Firstly, a kind of internal and external network isolation main control disc is provided, including first controller, first switching chip and second switching chip, the second switching chip includes multiple communication ports, the first port of the first switching chip is connected with the first controller, the second port of the first switching chip is connected with one of communication ports on the second switching chip, and the third port of the first switching chip is connected with external network port;Other communication ports on the second switching chip are also connected with internal network port and corresponding service disc respectively.
[0008] Preferably, the first switch chip comprises a first Media Access Control (MAC) unit and a first Physical Layer (PHY) unit, the first MAC unit comprises a first MAC chip, a second MAC chip and a third MAC chip, the first MAC chip and the second MAC chip are connected with the third MAC chip respectively; the third MAC chip is further connected with the first controller;
[0009] The first PHY unit comprises a first PHY chip and a second PHY chip; the first PHY chip is connected with the first MAC chip and the external network port respectively; the second PHY chip is connected with the second MAC chip and the communication port on the second switch chip respectively.
[0010] Preferably, the second switch chip comprises a second MAC unit and a second PHY unit, the second PHY unit is connected with the second PHY chip;
[0011] The second MAC unit comprises a plurality of MAC chips, the second PHY unit comprises a plurality of PHY chips; the MAC chips in the second MAC unit are connected with the PHY chips in the second PHY unit respectively;
[0012] The PHY chips in the second PHY unit are further connected with the internal network port and the corresponding service disk respectively.
[0013] Preferably, the master control disk further comprises a plurality of first network converters and a first connector, the PHY chips in the second PHY unit are connected with the corresponding first network converters respectively; the first network converters are further connected with the first connector and the internal network port respectively.
[0014] Preferably, the number of the PHY chips in the second switch chip is greater than or equal to 8.
[0015] Preferably, the first controller is connected with the third MAC chip through a media independent interface or a simplified media independent interface.
[0016] Preferably, the internal network port and the external network port are both RJ45 connectors.
[0017] In a second aspect, an embedded rack system for internal and external network isolation is provided, comprising the internal and external network isolation master control disk, the service disk, the power supply disk, the fan disk and the rack backplane as described in the first aspect; the master control disk, the service disk, the power supply disk and the fan disk are connected with the rack backplane.
[0018] Preferably, the service disk comprises a second controller, a third PHY chip, a second network converter and a second connector;
[0019] The second controller is connected with the third PHY chip, the third PHY chip is further connected with the second network converter, and the second network converter is further connected with the second connector.
[0020] Preferably, the second controller and the third PHY chip are connected through a media independent interface or a simplified media independent interface.
[0021] Compared with the prior art, the utility model has the advantages that:
[0022] The first exchange chip is a three-port chip, the first port and the third port constitute a communication loop of an external network, and the first port, the second port and the second exchange chip constitute a communication loop of an internal network, so that the network of the embedded rack system can be divided into an internal network and an external network, the isolation of the internal network is realized from the hardware level, complex configuration and maintenance are not needed, and the operation cost of enterprises is reduced. BRIEF DESCRIPTION OF DRAWINGS
[0023] In order to more clearly illustrate the technical scheme in the embodiments of the utility model or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or the prior art description, and obviously, the drawings in the following description are only some embodiments of the utility model, and for those skilled in the art, other drawings can be obtained according to these drawings without paying creative labor.
[0024] Figure 1 It is a structure schematic view of the main control disk for internal and external network isolation provided by the utility model embodiment;
[0025] Figure 2 It is a specific structure schematic view of the main control disk provided by the utility model embodiment;
[0026] Figure 3 It is a structure schematic view of the embedded rack system for internal and external network isolation provided by the utility model embodiment;
[0027] Figure 4 It is a structure schematic view of the service disk provided by the utility model embodiment. DETAILED DESCRIPTION
[0028] In order to make the purpose, technical scheme and advantages of the utility model clearer and more apparent, the utility model will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the utility model and are not used to limit the utility model.
[0029] Unless otherwise required by context, the term "comprises" or "comprising" as used in this specification is to be construed as meaning "comprises, but not limited to," or "comprising, but not limited to." In the description of the specification, the terms "one embodiment", "some embodiments", "exemplary embodiment", "example", "specific example" or "some examples" are intended to mean that a specific feature, structure, material or characteristic described in connection with the embodiment or example is included in at least one embodiment or example of the disclosure. The illustrative representation of the above terms does not necessarily mean the same embodiment or example. In addition, the specific features, structures, materials or characteristics described can be included in any one or more embodiments or examples in any appropriate manner, that is, although they are carried by the embodiments or examples of the above terms due to the order of appearance and location, they are not limited to being carried by one embodiment or example in a combined manner.
[0030] In the description of the utility model, the terms "first", "second" are only for description purpose, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features limited by "first", "second" can be explicitly or implicitly included in one or more features. In the description of the embodiments of the disclosure, unless otherwise stated, the meaning of "multiple" is two or more. In addition, for example, in the description, the same type of nouns can also be described as two independent individuals by adding "A", "B" at the end, in which case the features limited by "A", "B" are only used for the purpose of distinguishing the same type of individual description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features.
[0031] In describing some embodiments, "coupled", "coupling" and "connected" and their derivatives can be used. For example, the term "connected" can be used to describe some embodiments to indicate that two or more components have direct physical or electrical contact with each other. For another example, the term "coupling" can be used to describe some embodiments to indicate that two or more components have direct physical or electrical contact. However, the term "connected" or "coupled" can also refer to two or more components that do not have direct contact with each other, but still cooperate or interact with each other, such as "optical coupling", "wireless connection" and the like. The embodiments disclosed herein are not necessarily limited to the content of the utility model.
[0032] In addition, the technical features involved in each embodiment of the utility model described below can be combined with each other as long as they do not conflict with each other.
[0033] Embodiment 1
[0034] In order to ensure the security of data, the prior art uses VLAN technology, that is, a physical LAN is logically divided into a plurality of broadcast domain communication technologies, each VLAN is a broadcast domain, and hosts within a VLAN can directly communicate with each other, while VLANs cannot directly communicate with each other. In this way, broadcast messages are limited within a VLAN. The messages in different VLANs are isolated from each other during transmission, that is, the users in a VLAN cannot directly communicate with the users in other VLANs, so as to realize the isolation between the internal and external networks, thereby ensuring the security of data. However, the isolation effect of the internal and external networks based on the VLAN technology depends on the technical level and management experience of network management personnel, which will cause certain security risks of data security.
[0035] In order to solve the problems existing in the prior art, the embodiment provides a master control disk for internal and external network isolation, as shown in Figure 1 The second switch chip includes a plurality of communication ports, the first port of the first switch chip is connected with the first controller, the second port of the first switch chip is connected with one of the communication ports on the second switch chip, and the third port of the first switch chip is connected with an external network port. The other communication ports on the second switch chip are respectively connected with an internal network port and a corresponding service disk.
[0036] In one embodiment, the first switch chip is a three-port switch chip, and the second port and the third port thereof are respectively connected with the first port. One of the communication interfaces in the second switch chip is further connected with a corresponding power disk, and another communication interface in the second switch chip is further connected with a corresponding fan disk. In one embodiment, when the fan disk and the power disk are combined into a fan & power disk, it only needs to be connected with one of the communication interfaces in the second switch chip.
[0037] Among them, each service disk is used to collect its own data, and the collected data is transmitted to the master control disk through an internal network. The first controller has only one network port, and the main function of the master control disk is to be responsible for communication, to collect the information of the related service disks in real time, and to report to the network management for further analysis and processing. The internal network port refers to the port used by the application of the internal server. The external network port refers to the port used by the server application for accessing the mapping.
[0038] In one embodiment, the transmission link of the internal network comprises the first controller, the first port of the first switch chip, the second port of the first switch chip, the communication port on the second switch chip and the internal network port; and the transmission link of the external network comprises the first controller, the first port of the first switch chip, the third port of the first switch chip and the external network port.
[0039] In one embodiment, the internal network port and the external network port are both RJ45 connectors. The corresponding network transformers are integrated in the internal network port and the external network port.
[0040] The respective data collected by the service disks are transmitted in sequence to the second port and the first port of the first switch chip through the communication port on the second switch chip, and finally to the first controller. The first controller transmits the obtained data to the internal network through the transmission link of the internal network, or to the external network through the transmission link of the external network.
[0041] The master disk of the embodiment collects the information of the service disks in real time, and reports to the network management through the internal network or the external network. Compared with the existing technology, the data transmission efficiency of the embodiment is higher, the real-time performance is better, and the abnormal situation in the network can be found and handled in time.
[0042] In one embodiment, as shown in Figure 2 the first switch chip comprises a first MAC unit and a first PHY unit, the first MAC unit comprises a first MAC chip, a second MAC chip and a third MAC chip, the first MAC chip and the second MAC chip are connected with the third MAC chip respectively; the third MAC chip is further connected with the first controller; the first PHY unit comprises a first PHY chip and a second PHY chip; the first PHY chip is connected with the first MAC chip and the external network port respectively; the second PHY chip is connected with the second MAC chip and the communication port on the second switch chip respectively.
[0043] The first MAC unit and the first PHY unit work cooperatively to realize the functions of the data link layer and the physical layer, and ensure the accurate transmission of data between different devices.
[0044] The first MAC chip and the second MAC chip are connected with the third MAC chip, so that data exchange and processing can be performed between different MAC chips. The third MAC chip plays a key role in data aggregation and distribution, and can integrate data from the first MAC chip and the second MAC chip, and further process and forward the data as needed. The third MAC chip is the first port of the first switching chip, the first MAC chip and the first PHY chip form the third port of the first switching chip, and the second MAC chip and the second PHY chip form the second port of the first switching chip.
[0045] The first controller can control and manage the operation of the entire first MAC unit through the connection with the third MAC chip. For example, the first controller can send instructions to the third MAC chip to configure data forwarding rules, set network parameters, and the like, so as to ensure that the first MAC unit processes data according to the requirements of the system. In an embodiment, the first controller and the third MAC chip are connected through a media independent interface or a simplified media independent interface.
[0046] The first PHY chip is connected with the first MAC chip and the external network port respectively. The first PHY chip is responsible for processing signal conversion of the physical layer, converting the digital signal transmitted by the first MAC chip into a physical signal suitable for transmission on the external network medium (such as a network cable), and also converting the physical signal received from the external network port into a digital signal for the first MAC chip to process.
[0047] Similarly, the second PHY chip is responsible for signal conversion of the physical layer, so that the second MAC chip can communicate with the second switching chip at the physical layer. Through the above connection mode, the first switching chip can realize data interaction with the second switching chip, and further realize data flow between the internal and external networks and communication with the service disk. In summary, the first switching chip completes the functions from the physical layer to the data link layer through the connection between the chips of the internal first MAC unit and the first PHY unit.
[0048] In an embodiment, referring to Figure 2 , the second switching chip includes a second MAC unit and a second PHY unit, the second PHY unit is connected with the second PHY chip; the second MAC unit includes a plurality of MAC chips (indicated as MAC in the figure), and the second PHY unit includes a plurality of PHY chips (indicated as PHY in the figure); the MAC chips in the second MAC unit are connected with the PHY chips in the second PHY unit respectively; and the PHY chips in the second PHY unit are further connected with the internal network port and the corresponding service disk respectively.
[0049] In the second switch chip, one MAC chip corresponds to one PHY chip to form one communication port. In the second switch chip, multiple communication ports are needed, one of which is used to connect with the internal network port, and another of which needs to connect with at least one service disk. In an embodiment, the number of PHY chips in the second switch chip can be greater than or equal to 8. That is, at least 8 communication ports are included, at least 6 of which respectively communicate with 6 service disks, and the other two of which respectively connect with a power disk and a fan disk. More details of this embodiment are not described herein.
[0050] In an embodiment, the external network has a data request to access certain data on the service disk. The data first enters the first switch chip from the external network port, is processed by the first MAC unit and the first PHY unit, and is then transmitted to the second PHY unit of the second switch chip through the second PHY chip of the first switch chip. The second PHY unit of the second switch chip converts the physical signal into a digital signal and transmits it to the second MAC unit. The second MAC unit determines, according to the target address of the data, that the data is to access the service disk, and then sends the data frame to the service disk through the PHY chip of the corresponding second PHY unit. After the service disk processes the data, the response data is transmitted back along the reverse path, and is finally transmitted to the external network through the external network port.
[0051] In an embodiment, referring to Figure 2 , the master disk further includes a plurality of first network converters and a first connector, and the PHY chips in the second PHY unit are respectively connected with the corresponding first network converters; the first network converters are further respectively connected with the first connector and the internal network port.
[0052] In the second PHY unit, the PHY chips are responsible for converting digital signals into analog signals suitable for transmission on a physical medium. The first network converters here play a role in further processing and adapting signals. For example, filtering, enhancing, and other operations are performed on the signals output by the PHY chips in the second PHY unit to improve the quality and stability of the signals, so that they are more suitable for transmission in the internal network environment. Different PHY chips correspond to different first network converters, which ensures the independence and accuracy of each data transmission path.
[0053] The first connector is an interface component for connecting different devices or modules, which provides a standardized connection interface for the first network converter. Through the first connector, the first network converter can be conveniently connected and communicated with other devices or modules. This connection mode makes the structure of the master control disk more modular, facilitating the installation, maintenance and upgrading of the device. For example, when the first network converter needs to be replaced or expanded, it can be achieved by plugging and unplugging the first connector, without the need for large-scale disassembly and rewiring of the entire master control disk. The signal processed and adapted by the first network converter enters the internal network through the internal network port for use by internal devices. The first network converter ensures that the data signal entering the internal network is of good quality and can meet the receiving requirements of the internal network devices, thereby ensuring smooth data communication. It is worth noting that the first network converter connected with the internal network port does not need to pass through the first connector.
[0054] In summary, in the embodiment, the first switching chip is a three-port chip, the first port and the third port constitute a communication loop of the external network, and the first port, the second port and the second switching chip constitute a communication loop of the internal network. The network of the embedded rack system can be divided into an internal network and an external network, the isolation of the internal network is realized from the hardware level, without complex configuration and maintenance, and the operation cost of the enterprise is reduced. Compared with the existing VLAN technology, the internal and external networks can be more effectively and safely isolated by the hardware isolation mode, the isolation effect is more reliable, and is not easily affected by the technical level and management experience of the network management personnel, thereby effectively improving the security of data.
[0055] Embodiment 2:
[0056] In embodiment 1, a master control disk for isolating internal and external networks is proposed. In this embodiment, an embedded rack system for isolating internal and external networks will be proposed, as shown in Figure 3 The master control disk, the service disk, the power supply disk, the fan disk and the rack backboard are connected with each other.
[0057] The rack backboard serves as a basic support structure, provides a physical installation platform and an electrical connection path for the master control disk and the like, and cooperates to realize the isolation of internal and external networks and related service functions. In an embodiment, the power supply disk and the fan disk can be self-provided or externally connected.
[0058] In an embodiment, as shown in Figure 4As shown, the service disk includes a second controller, a third PHY chip, a second network converter and a second connector; the second controller is connected with the third PHY chip, the third PHY chip is further connected with the second network converter, and the second network converter is further connected with the second connector. The network architecture of the power disk and the fan disk is the same as that of the service disk, and thus will not be described herein. Based on the functional difference, the service disk, the power disk and the fan disk each have other functional components, which will not be described herein.
[0059] The service disk assumes the function of processing specific services in the entire inner-outer network isolated embedded rack system. Through the connection with the master disk, the service disk receives data from the outer network or the inner network, and processes the data under the control of the second controller, and can also feed back the processed data to the corresponding network.
[0060] The rack backplane is provided with a connector matched with the first connector of the master disk and the second connector of the service disk, and the first connector and the second connector are connected with the rack backplane. Through this connection mode, the electrical connection between the two disks is realized, so that data can be stably transmitted between them. For example, the master disk transmits the service data from the outer network to the rack backplane through the first connector after processing, and then provides data source for data processing of the service disk through the second connector.
[0061] In one embodiment, the outer network has a service request sent to the master disk, and the master disk transmits the data to the service disk through the first connector, the rack backplane and the second connector after preliminary processing. After entering the service disk, the data is processed and adapted by the second network converter, and then the third PHY chip converts the signal into a digital signal and transmits it to the second controller. The second controller analyzes and processes the data, for example, performs data storage, calculation and other operations. After processing is completed, the second controller sends the result data to the third PHY chip, and the third PHY chip converts it into a physical signal, which is further processed by the second network converter, and finally fed back to the master disk through the second connector, the rack backplate and the first connector. The master disk forwards the data to the corresponding destination. It is worth noting that the content related to the processing method in this embodiment is all prior art, and will not be described in detail in this embodiment.
[0062] In one embodiment, the second controller and the third PHY chip are connected through a media independent interface or a simplified media independent interface.
[0063] The connection mode based on the medium independent interface or the simplified media independent interface enables the effective data communication between the first controller and the third MAC chip and between the second controller and the third PHY chip, guarantees the smooth transmission of the internal data of the master control disk and the service disk, and supports the normal operation of the entire embedded rack system with the internal and external network isolation.
[0064] The specific structure of the master control disk with the internal and external network isolation is described in Embodiment 1, and will not be repeated in this embodiment.
[0065] The above merely describes the preferred embodiments of the present application, and is not intended to limit the present application, and any modification, equivalent replacement, improvement and the like within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A master control board with internal and external network isolation, characterized in that, It includes a first controller, a first switching chip, and a second switching chip. The second switching chip includes multiple communication ports. A first port of the first switching chip is connected to the first controller. A second port of the first switching chip is connected to one of the communication ports on the second switching chip. A third port of the first switching chip is connected to an external network port. Other communication ports on the second switching chip are also connected to an internal network port and a corresponding service board, respectively.
2. The main control board with internal and external network isolation according to claim 1, characterized in that, The first switching chip includes a first MAC unit and a first PHY unit. The first MAC unit includes a first MAC chip, a second MAC chip, and a third MAC chip. The first MAC chip and the second MAC chip are respectively connected to the third MAC chip. The third MAC chip is also connected to the first controller. The first PHY unit includes a first PHY chip and a second PHY chip; the first PHY chip is connected to the first MAC chip and the external network port respectively; the second PHY chip is connected to the second MAC chip and the communication port on the second switching chip respectively.
3. The main control board with internal and external network isolation according to claim 2, characterized in that, The second switching chip includes a second MAC unit and a second PHY unit, and the second PHY unit is connected to the second PHY chip; The second MAC unit includes multiple MAC chips, and the second PHY unit includes multiple PHY chips; the MAC chips in the second MAC unit are respectively connected to the PHY chips in the second PHY unit. The PHY chip in the second PHY unit is also connected to the internal network port and the corresponding service board.
4. The main control board with internal and external network isolation according to claim 3, characterized in that, The main control board also includes multiple first network converters and first connectors. The PHY chip in the second PHY unit is connected to the corresponding first network converter. The first network converter is also connected to the first connector and the internal network port.
5. The main control board with internal and external network isolation according to claim 3, characterized in that, The number of PHY chips in the second switching chip is greater than or equal to 8.
6. The main control board with internal and external network isolation according to claim 2, characterized in that, The first controller and the third MAC chip are connected via a media-independent interface or a simplified media-independent interface.
7. The main control board with internal and external network isolation according to claim 1, characterized in that, Both the internal network port and the external network port are RJ45 connectors.
8. An embedded rack system with internal and external network isolation, characterized in that, It includes a main control board, service board, power supply board, fan board, and rack backplane as described in any one of claims 1-7, wherein the main control board, the service board, the power supply board, and the fan board are all connected to the rack backplane.
9. The embedded rack system with internal and external network isolation according to claim 8, characterized in that, The service panel includes a second controller, a third PHY chip, a second network converter, and a second connector; The second controller is connected to the third PHY chip, the third PHY chip is also connected to the second network converter, and the second network converter is also connected to the second connector.
10. The embedded rack system with internal and external network isolation according to claim 9, characterized in that, The second controller is connected to the third PHY chip via a media-independent interface or a simplified media-independent interface.