A low-latency network isolation switch with proprietary security protocols

Abstract

A low-latency network isolation switching device with a proprietary security protocol adopts a "2+1" physical structure design, including an external processing unit (1), an isolation component unit (2) based on high-performance FPGA+DMA technology, and an internal processing unit (3). The external processing unit (1) receives external network data, performs preliminary parsing and preprocessing, and then transmits it to the isolation component unit (2). The isolation component unit (2) receives data from the external processing unit (1), and the internal processing unit (3) receives the processed data from the isolation component unit (2), processes and converts it, and then sends it to the internal network. A solid-state electronic storage module (4) is used to store operating parameters, proprietary security protocol information, and data processing logs. The overall device has multi-functional isolation switching capabilities, is suitable for different security domain isolation and data exchange needs, and has a wide range of applications.

Description

Technical Field

[0001] This utility model relates to the field of network security isolation technology, specifically to a low-latency network isolation switching device with a proprietary security protocol. Background Technology

[0002] In today's network environment, the demand for data exchange between different security domains is increasing, while network attack methods are becoming more complex and diverse, placing extremely high demands on the security, efficiency, and reliability of network isolation switching devices. Existing network isolation equipment, such as traditional network gateways and optical gateways, often suffer from high latency and insufficient throughput when facing high-bandwidth network environments, making it difficult to meet the needs of rapid exchange of large amounts of data.

[0003] Furthermore, the security protocols used by these devices are mostly general-purpose protocols, which are not sufficiently secure in specific scenarios, making them vulnerable to targeted cyberattacks and increasing the risk of sensitive data leakage. Moreover, the structural design of some devices is inadequate, failing to strike a balance between isolation effectiveness and data processing efficiency, and thus unable to adapt well to network environments of different sizes and security levels.

[0004] Therefore, developing a network isolation switching device suitable for high-bandwidth networks, featuring low latency, high throughput, and high reliability, and employing proprietary security protocols, has become an important topic in the field of network security isolation technology. Utility Model Content

[0005] The purpose of this invention is to overcome the problems of high latency, insufficient throughput, inadequate security, and unreasonable structural design of existing network isolation devices in high-bandwidth network environments, and to provide a low-latency network isolation switching device with a proprietary security protocol.

[0006] The technical solution adopted by this utility model to solve its technical problem is:

[0007] A low-latency network isolation switching device with a proprietary security protocol adopts a "2+1" physical structure design, including an external processing unit 1, an isolation component unit 2 based on high-performance FPGA+DMA technology, and an internal processing unit 3.

[0008] The device is also equipped with a private security protocol module 22, a high-performance cache module 23, a solid-state electronic storage module 4, and a self-designed multi-channel concurrent FPGA isolation card 21.

[0009] External processing unit 1 is used to receive data from an external network, perform preliminary parsing and preprocessing on the data, and then transmit the processed data to isolation component unit 2.

[0010] The isolation unit 2 is based on high-performance FPGA+DMA technology. It receives data transmitted from the external processing unit 1 and performs data isolation and exchange processing through the multi-channel concurrent FPGA isolation card 21. At the same time, during the processing, it calls the private security protocol module 22 to encrypt and verify the data, and uses the high-performance cache module 23 to temporarily store the data to improve the processing speed.

[0011] The internal processing unit 3 receives the data processed by the isolation component unit 2, performs further processing and conversion, and then sends the data to the internal network.

[0012] Solid-state electronic storage module 4 is used for storing the operating parameters of the storage device, information related to private security protocols, and necessary logs during data processing.

[0013] This utility model also has the following additional technical features:

[0014] As a further specific optimization of the technical solution of this utility model: the external processing unit 1 adopts a high-performance processor chip, which can perform preliminary checks on the format and integrity of the data.

[0015] As a further specific optimization of the technical solution of this utility model: the FPGA chip in the isolation component unit 2 is a high-performance model, and the multi-channel concurrent FPGA isolation card 21 has multiple independent isolation channels.

[0016] As a further specific optimization of the technical solution of this utility model: the private security protocol module 22 has a built-in specially designed encryption algorithm and security verification mechanism.

[0017] As a further specific optimization of the technical solution of this utility model: the high-performance cache module 23 adopts a large-capacity high-speed cache chip.

[0018] As a further specific optimization of the technical solution of this utility model: the solid-state electronic storage module 4 is a high-reliability solid-state hard drive.

[0019] Compared with the prior art, the advantages of this utility model are:

[0020] Advantage 1: The “2+1” physical structure design, through the collaborative work of external processing unit 1, isolation component unit 2 and internal processing unit 3, effectively isolates the external network from the internal network, and improves the security of data exchange between network security domains.

[0021] Advantage 2: The isolation component unit 2 based on high-performance FPGA+DMA technology and the self-designed multi-channel concurrent FPGA isolation card 21 greatly improve the efficiency of data processing and exchange, realize high throughput characteristics, and effectively reduce data transmission latency, meeting the needs of high-bandwidth network environments.

[0022] Advantage 3: Equipped with a private security protocol module 22, compared with general security protocols, it can better cope with network attacks in specific scenarios, improve the security of data transmission, effectively block direct network attack activities, and prevent sensitive data from being leaked.

[0023] Advantage 4: The high-performance cache module 23 and solid-state electronic storage module 4 not only improve the data processing speed, but also ensure the reliability and stability of data storage during device operation.

[0024] Advantage 5: The overall device has multi-functional isolation and switching capabilities, suitable for different security domain isolation and data exchange needs, and has a wide range of applications. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the structure of this utility model.

[0026] Explanation of reference numerals in the attached drawings: External processing unit 1, Isolation component unit 2, Internal processing unit 3, Solid-state electronic storage module 4. Detailed Implementation

[0027] Exemplary embodiments of the present invention will now be described in more detail with reference to the accompanying drawings.

[0028] A low-latency network isolation switching device with a proprietary security protocol adopts a "2+1" physical structure design, consisting of an external processing unit 1, an isolation component unit 2, and an internal processing unit 3.

[0029] External processing unit 1 uses a high-performance processor chip, which can quickly receive data sent from external networks and perform preliminary checks and parsing on the data format and integrity, removing invalid and erroneous data, and improving the efficiency of subsequent processing.

[0030] The FPGA chip in isolation unit 2 is a high-performance model, working in conjunction with DMA technology to achieve high-speed data transmission and processing. The multi-channel concurrent FPGA isolation card 21 is a custom design with multiple independent isolation channels, capable of handling multiple data transmission tasks simultaneously, improving the parallelism of data exchange. The proprietary security protocol module 22 incorporates a specially designed encryption algorithm and security verification mechanism. After data enters isolation unit 2, it encrypts the data and performs real-time security verification during data transmission to prevent data tampering or theft. The high-performance cache module 23 uses a large-capacity high-speed cache chip, capable of temporarily storing large amounts of data, reducing data access latency, and improving data processing speed.

[0031] The internal processing unit 3 is also equipped with a high-performance processor. After receiving the securely processed data transmitted by the isolation component unit 2, it performs data format conversion and adaptation according to the internal network protocol and requirements to ensure that the data can enter the internal network accurately and efficiently.

[0032] Solid-state electronic storage module 4 uses a highly reliable solid-state drive, and the storage capacity is configured according to actual needs. It is used to store the operating parameters of the storage device, such as data transfer rate and encryption level; store update files and key information of private security protocols; and record data exchange logs, including the time, source and destination of data transmission, which facilitates subsequent auditing and troubleshooting.

[0033] When data needs to be transmitted from the external network to the internal network, the data is first received by the external processing unit 1. External processing unit 1 performs preliminary parsing and preprocessing of the data, removing invalid information, and then sends the data to the isolation component unit 2. Isolation component unit 2 rapidly receives the data using FPGA+DMA technology. A multi-channel concurrent FPGA isolation card 21 isolates and distributes the data, a private security protocol module 22 encrypts and verifies the data, and a high-performance cache module 23 temporarily stores the data to accelerate the processing flow. After processing, the data is transmitted to the internal processing unit 3, which performs format conversion and other processing before sending it to the internal network. Throughout the entire process, the solid-state electronic storage module 4 records relevant information in real time, ensuring the stable operation and traceability of the device. Example 1

[0034] External processing unit 1 employs a high-performance processor chip, specifically an Intel Xeon E-2388G. This unit receives data packets from an external network and performs preliminary parsing, packet format checking, and integrity verification. The processed valid data is then transmitted to isolation component unit 2 via a dedicated high-speed interface.

[0035] The isolation component unit 2 is the core isolation switching module, whose core is a high-performance Xilinx UltraScale+ series FPGA chip (e.g., XCVU9P), and is equipped with a multi-channel concurrent FPGA isolation card 21. This isolation card 21 provides at least four physically isolated hardware channels, each with an independent DMA controller, enabling high-speed, concurrent data transmission in physically isolated states. Before entering the isolation card 21, data undergoes hardware-accelerated encryption (using a self-developed hybrid encryption algorithm) and security verification (such as a hardware-based two-way authentication mechanism) by the proprietary security protocol module 22. During processing, the data stream is temporarily buffered by a high-performance cache module 23, which uses a large-capacity Micron DDR4 SDRAM chip with a capacity of no less than 16GB to ensure low-latency data exchange.

[0036] The internal processing unit 3 receives the secure data stream from the isolation component unit 2. It also uses a high-performance processor (such as an Intel Core i7-12700) and is responsible for the final processing, protocol conversion (e.g., converting external protocols to internal network protocols) and forwarding of the data, and sends the processed data to the target device in the internal network.

[0037] Solid-state electronic storage module 4 uses a high-reliability enterprise-grade SATA SSD (such as Samsung PM893) with a capacity of 1TB. It is connected to the isolation component unit 2 through a dedicated interface and is used to persist the operating configuration parameters of the storage device, the key and policy information required by the private security protocol module 22, as well as detailed data processing operation logs and audit information. Example 2

[0038] A method for using a low-latency network isolation switch with a proprietary security protocol:

[0039] In practical implementation, the device's operating parameters can be dynamically adjusted according to the actual network environment. For example, the upper limit of the data transmission rate can be configured through the external processing unit 1, or the private security protocol algorithm can be updated through the solid-state electronic storage module 4 to adapt to new network threats. During data transmission, the high-performance cache module 23 adopts a multi-level caching strategy, combined with the zero-copy mechanism of DMA technology, which significantly reduces data access latency. The measured latency is less than 1 millisecond, making it suitable for highly sensitive scenarios such as real-time monitoring systems.

[0040] Furthermore, the multi-channel concurrent FPGA isolation card 21 supports channel redundancy design, automatically switching to a backup channel when a single channel fails, ensuring the continuity and reliability of data exchange. The proprietary security protocol module 22 integrates an enhanced encryption mechanism based on quantum key distribution, providing end-to-end protection for transmitted data and effectively resisting man-in-the-middle attacks and replay attacks. In actual deployments across different security domains such as industrial control and government networks, the device has been verified to achieve a throughput of up to 20Gbps while maintaining 99.99% availability. The solid-state electronic storage module 4 uses RAID technology for redundant storage of log information and supports a remote audit interface, facilitating administrators to trace the history of data exchange.

[0041] The above detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention.

Claims

1. A low-latency network isolation switching device with private security protocol, characterized by: The physical structure is designed as "2+1", including an external processing unit (1), an isolation component unit (2) based on high-performance FPGA+DMA technology, and an internal processing unit (3). The isolation component unit (2) is also equipped with a private security protocol module (22), a high-performance cache module (23), a solid-state electronic storage module (4), and a self-designed multi-channel concurrent FPGA isolation card (21). The external processing unit (1) is used to receive external network data and perform preliminary parsing and preprocessing before transmitting it to the isolation component unit (2). The isolation component unit (2) receives data from the external processing unit (1), performs isolation and exchange processing through the multi-channel concurrent FPGA isolation card (21), calls the private security protocol module (22) for encryption and security verification, and uses the high-performance cache module (23) to temporarily store the data. The internal processing unit (3) receives the data processed by the isolation component unit (2), processes and converts it, and then sends it to the internal network. The solid-state electronic storage module (4) is used to store operating parameters, private security protocol information and data processing logs.

2. The low latency network isolation switch with private security protocol of claim 1, wherein: The external processing unit (1) uses a high-performance processor chip, which can perform preliminary checks on the format and integrity of the data.

3. The low latency network isolation switch with private security protocol of claim 1, wherein: The FPGA chip in the isolation component unit (2) is a high-performance model, and the multi-channel concurrent FPGA isolation card (21) has multiple independent isolation channels.

4. The low latency network isolation switch with private security protocol of claim 1, wherein: The private security protocol module (22) has a built-in specially designed encryption algorithm and security verification mechanism.

5. The low latency network isolation switch with private security protocol of claim 1, wherein: The high-performance cache module (23) uses a high-capacity high-speed cache chip.

6. A low-latency network isolation switching device with a proprietary security protocol according to claim 1, characterized in that: The solid-state electronic storage module (4) is a high-reliability solid-state hard drive.

Images