Safe data acquisition gateway based on DPDK network card isolation

Abstract

The utility model discloses a safe data acquisition gateway based on DPDK network card isolation, which is characterized by comprising an upper mainboard, an isolation card and a lower mainboard, and the isolation card is in line connection with the upper mainboard and the lower mainboard through a USB interface; one end of the lower mainboard is in two-way communication with m terminals of a control system through TCP / IP, one end of the upper mainboard is in two-way communication with n terminals of an MES system through TCP / IP, and m and n are natural numbers determined according to the actual industrial environment. According to the safe data acquisition gateway based on DPDK network card isolation, the USB interface is adopted to replace TCP / IP communication to realize isolation of the sending end and the receiving end, the anti-interference and anti-virus capabilities are strong, and the safety of the safe data acquisition gateway is significantly improved.

Description

TECHNICAL FIELD

[0001] The utility model relates to communication field, specifically a kind of safe data acquisition gateway based on DPDK network card isolation. BACKGROUND

[0002] The development of industrialization and informationization realizes the close integration of traditional computer network and industrial control network, and more and more enterprise management information systems, such as production execution systems (MES) of typical process industries such as petroleum and chemical industry, collect real-time data from control systems using various data interaction devices, and then complete optimization control. Especially with the gradual deepening application of new technologies such as Internet of Things and big data, the connection between management network and industrial control network is becoming closer and closer, which expands the access range of industrial control network, but also increases the security risk.

[0003] In order to collect production data of control system into MES, the existing data acquisition gateway generally uses Windows or Linux operating system, uses similar TCP / IP communication technology with industrial control network or management network to communicate with control system or MES system, and virus can attack control network or MES system by using operating system vulnerability or TCP / IP communication vulnerability; When part of the USB interface is used for communication, the communication rate is low, and full-duplex communication is not supported. UTILITY MODEL CONTENT

[0004] In view of the above problems, the utility model discloses a kind of safe data acquisition gateway based on DPDK network card isolation, and the isolation of sending end and receiving end is realized based on DPDK network card TCP / IP communication, and the utility model is realized by following technical scheme:

[0005] A kind of safe data acquisition gateway based on DPDK network card isolation, including upper mainboard, isolation unit and lower mainboard, wherein: the isolation unit includes two DPDK network cards including respectively through PCIe interface and upper mainboard and lower mainboard line connection;Lower mainboard one end is communicated with control system m terminal bidirectionally by TCP / IP, and upper mainboard one end is communicated with MES system n terminal bidirectionally by TCP / IP, and m, n are natural number determined according to actual industrial environment.

[0006] Isolation unit includes two DPDK network cards between connection by Ethernet cable, DPDK network card is analyzed and retransmitted to specific data packet, and DPDK network card is preferably Intel i40e network card.

[0007] Lower mainboard uses general x86 or ARM computer mainboard based, and the TCP / IP interface of mainboard is connected with external control system.

[0008] Upper mainboard uses general x86 or ARM computer mainboard based, and the TCP / IP interface of mainboard is connected with external MES system.

[0009] The model of the upper host board and the lower host board is Beijing Leyan RIS-6840.

[0010] Advantages

[0011] The safety data acquisition gateway based on DPDK network card isolation of the utility model, based on DPDK network card TCP / IP communication realizes the isolation of sending end and receiving end, and through the inherent function of DPDK network card, specific data packet is parsed and forwarded, and the anti-interference and anti-virus ability is strong, and the safety of the utility model is significantly improved, and the transmission speed is faster than that of the safety gateway based on USB isolation. BRIEF DESCRIPTION OF DRAWINGS

[0012] Figure 1 It is a safety data acquisition gateway frame structure schematic diagram based on DPDK network card isolation of the utility model; DETAILED DESCRIPTION

[0013] The technical scheme in the utility model embodiment will be further described below with reference to the drawings in the utility model embodiment:

[0014] As Figure 1 Indicated, a kind of safety data acquisition gateway based on DPDK network card isolation, including upper host board, isolation unit and lower host board, wherein: the isolation unit includes two DPDK network cards respectively through PCIe interface and upper host board and lower host board line connection;Lower host board one end is through TCP / IP and control system m terminal bidirectional communication, upper host board one end is through TCP / IP and MES system n terminal bidirectional communication, m, n are natural number determined according to actual industrial environment, in this embodiment, both are 1.

[0015] Isolation unit includes two DPDK network cards between through Ethernet network cable connection, DPDK network card is parsed and forwarded to specific data packet, and DPDK network card is preferably Intel i40e network card.

[0016] Lower host board uses general based on x86 or ARM computer host board, and the TCP / IP interface of host board is connected with external control system.

[0017] Upper host board uses general based on x86 or ARM computer host board, and the TCP / IP interface of host board is connected with external MES system.

[0018] The model of the upper host board and the lower host board is Beijing Leyan RIS-6840.

[0019] The utility model discloses a kind of based on DPDK network card isolation's safe data acquisition gateway, based on DPDK network card TCP / IP communication and the isolation of sending end and receiving end are realized, DPDK network card is parsed and is forwarded to specific data packet, anti-interference, strong anti-virus capability, significantly improve the security of the utility model;And compared with the safe gateway based on USB isolation has faster transmission speed.

[0020] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the relevant hardware through circuit setting, which can be completed by a single-chip microcomputer or other similar functional integrated chips, which is prior art. The core utility model point of the utility model is the overall structure layout of the system, and the local control method can be completed by programming of the prior art; the local module connection can be realized by the prior art. Specifically in the present application, the innovation point lies in that the isolation of the sending end and the receiving end is realized by setting the DPDK network card to construct an isolation unit. Among them, the DPDK network card realizes the parsing and forwarding of specific data packets, which is the inherent function of the DPDK network card; the DPDK network card is connected to the upper host board and the lower host board through the PCIe interface, and the connection of the TCP / IP interface and the external control system / external MES system is all prior art.

Claims

1. A secure data acquisition gateway based on DPDK network card isolation, characterized in that... It includes an upper-level motherboard, an isolation unit, and a lower-level motherboard. The isolation unit includes two DPDK network cards, which are connected to one end of the upper-level motherboard and one end of the lower-level motherboard via PCIe interfaces, respectively. The other end of the lower-level motherboard communicates bidirectionally with m terminals of the control system via TCP / IP, and the other end of the upper-level motherboard communicates bidirectionally with n terminals of the MES system via TCP / IP. m and n are natural numbers determined according to the actual industrial environment.

2. The secure data acquisition gateway based on DPDK network card isolation according to claim 1, characterized in that... The two DPDK network cards are connected via an Ethernet cable. The DPDK network card model is Intel i40e.

3. A secure data acquisition gateway based on DPDK network card isolation as described in claim 1, characterized in that... The lower-level motherboard uses a common x86 or ARM-based computer motherboard, and the motherboard's TCP / IP interface is connected to the external control system.

4. A secure data acquisition gateway based on DPDK network card isolation as described in claim 1, characterized in that... The host motherboard uses a common x86 or ARM-based computer motherboard, and the motherboard's TCP / IP interface is connected to an external MES system.

5. A secure data acquisition gateway based on DPDK network card isolation as described in claim 1, characterized in that... The model of the upper and lower motherboards is Beijing Leyan RIS-6840.

Images