CN202042898U - A program-controlled bypass protection circuit for network equipment - Google Patents

Abstract

The utility model discloses a program controlled bypass protection circuit of network equipment, which comprises a program control chip, an electronic switch integrated chip, a watch dog module, a universal series bus (USB) port, a physical interface communication signal processing module and a battery. The electronic switch integrated chip is connected with a media interface controller and a physical interface transceiver of the network equipment. The program control chip is connected with the battery and the electronic switch integrated chip. The program control chip is connected with an external monitoring device through the USB port. The program control chip is connected with the physical interface transceiver of the network equipment through the physical interface communication signal processing module and is connected with a central processing unit (CPU) in the network equipment through the watch dog module and further connected with a power supply of the network equipment. The program controlled bypass protection circuit of the network equipment utilizes a high speed switch chip to realize opening and closing functions of a circuit, replaces a heavy relay circuit, and realizes opening and closing operation of multiple interfaces.

Description

A program-controlled bypass protection circuit for network equipment

technical field

The utility model relates to a circuit protection technology, in particular to a program-controlled bypass protection circuit of network equipment.

Background technique

While ensuring network security, network administrators must also ensure that the network is always connected. For critical network partitions, ensuring network connectivity is especially important, requiring all traffic to be inspected for malicious behavior. The high-availability solution can realize failover between the primary device and the backup device, reducing the risk of network interruption while providing security services. However, if it is necessary to further reduce the risk, such as a network disconnection caused by a power failure or a safety device failure, a device fault bypass solution is required. Automatic fault bypass will ensure network connectivity.

Existing technologies such as the hardware bypass module provided by Fortinet can be installed in a single-width expansion slot, provide 4 Ethernet ports, and provide circuit breaker protection for two partitions in the network.

The network bypass function or module provided in the prior art is often processed in parallel with the original network path. When a failure occurs, the network device will switch the network traffic to the bypass module. Since they are all controlled by relays, they generally only support Smaller number of interfaces and need for redundant network communication connections. In addition, the cost of the relay control circuit is relatively high, and the volume of the control module is relatively large, so the failover time can only be fixed at the millisecond level.

It can be seen that the existing network bypass technology has the following problems:

(1) Existing network bypass modules require redundant network connections, and cannot provide bypass functions for network interfaces in use.

(2) At present, the bypass circuit is generally controlled by a relay, which has the disadvantages of high cost, large volume of the control circuit, small number of supported network interfaces, and slow bypass switching speed.

(3) The existing bypass method is not flexible. Assume that a company has three network partitions, one Internet exit, two of which are key business departments, which must maintain connectivity but can also access the Internet under protected conditions, and the other partition is provided by the DMZ. Serve. If the MAC chip of some interfaces fails, the PHY interface is still normal, and other interfaces of the network device are also normal, which can still provide security protection functions. According to the existing bypass mode, the two business departments can still visit each other, but the DMZ partition will be directly exposed to the Internet, which is easy to be attacked.

Utility model content

The utility model aims at the problems existing in the existing network bypass technology, and provides a program-controlled bypass protection circuit for network equipment. The bypass protection circuit uses a high-speed switch chip to realize the switching function of the circuit, replacing the bulky relay circuit, realizing Switching of multiple interfaces.

In order to achieve the above object, the utility model adopts the following technical solutions:

A program-controlled bypass protection circuit for network equipment, the protection circuit includes a program-controlled chip, an electronic switch integrated chip, a watchdog module, a USB interface, a physical interface communication signal processing module, and a battery, and the electronic switch integrated chip is connected to the network equipment In the media interface controller and the physical interface transceiver, the program-controlled chip is connected to the battery and the electronic switch integrated chip, the program-controlled chip is connected to an external monitoring device through a USB interface, and the program-controlled chip is connected to a communication signal processing module through a physical interface The physical interface transceiver in the network device, the program-controlled chip is connected to the CPU in the network device through the watchdog module, and connected to the power supply in the network device.

In an example of the present invention, the electronic switch integrated chip includes a first set of switch logic and a second set of switch logic, and the first set of switch logic is used for media interface controllers and physical interface transceivers in network equipment The second group of switch logic is used for the connection between the physical interface transceivers in the network equipment.

The bypass circuit provided by the utility model uses a high-speed electronic switch integrated chip to program control the electrical interface (such as RJ45 connector) on the network equipment, and can receive the input of external conditions, combined with a variety of technologies to ensure high availability of the system. feedback, automatically customize various bypass strategies, and realize functions such as fault bypass and power-off bypass between any two adjacent interfaces without redundant network connections.

Compared with the bypass control realized by the relay, the utility model uses a high-speed electronic switch integrated chip with lower cost, improved breaking efficiency, solves the complexity problem of multi-interface breaking in practical application, and realizes small size , the reaction speed can reach the microsecond level, the service life is long and the energy consumption is low.

At the same time, the switch chip is used to realize the synchronous switching function of a large number of interfaces, which solves the problem that the existing technology can only realize the on-off of a few interfaces, and realizes the on-off of the communication connection applied in the large network environment.

Furthermore, the utility model realizes programmable control by using a switch chip, and the switch logic used for programming may be more complicated but more convenient to use.

Finally, the utility model has a peripheral control interface, which can monitor network communication through an external monitoring device so as to control the switch circuit according to the network status

Description of drawings

The utility model will be further described below in conjunction with the accompanying drawings and specific embodiments.

Fig. 1 is the structural representation of the utility model.

Detailed ways

In order to make the technical means, creative features, goals and effects achieved by the utility model easy to understand, the utility model will be further elaborated below in conjunction with specific illustrations.

Referring to Fig. 1, the program-controlled bypass protection circuit 100 of network equipment provided by the utility model includes a program-controlled chip 101, an electronic switch integrated chip 102, a watchdog module 103, a USB interface 105, a physical interface communication signal processing module 104 and a battery 106.

Wherein, the electronic switch integrated chip 102 is used to control the opening and closing of the connection between the media interface controller (MAC) 600 and the physical interface transceiver (PHY) 500 in the network equipment.

The program-controlled chip 101 is the control core of the entire protection circuit, which controls and connects the battery 106 and the electronic switch integrated chip 102, and connects the external monitoring device 400 through the USB interface 105, and connects the physical interface in the network device through the physical interface communication signal processing module 104 The transceiver 500 is also connected to the CPU 200 in the network device through the watchdog module 103 and connected to the power supply 300 in the network device.

Based on such scheme, the concrete implementation of the present utility model is as follows:

Referring to Fig. 1, relate to 4-port switch in this embodiment, 4-port switch is connected with switch controller 700 by CPU200 by bus, switch controller 700 provides the cache memory based on the network data frame on chip for 4 MAC chips 600, each physical The interface PHY500 is connected with the corresponding MAC chip 600 to provide external data communication services.

In order to provide a bypass function, a high-speed electronic switch integrated chip 101 is used between the MAC chip 600 and the physical interface PHY500 to form a bypass circuit 100 in the present invention.

The electronic switch integrated chip 101 includes a first group of switching logics and a second group of switching logics, the first group of switching logics includes switching logics A-D, and the second group of switching logics includes switching logics E-G.

Among them, the opening and closing of MAC1 and PHY1 is controlled by switch logic A, the opening and closing of MAC2 and PHY2 is controlled by switch logic B, and so on, and the number of supported interfaces increases.

The opening and closing of the circuit between PHY1 and PHY2 is controlled by the switch logic E, the opening and closing of the circuit between PHY2 and PHY3 is controlled by the switch control logic F, and so on, and the number of supported interfaces increases. In fact, there are many connections between the interfaces. For example, the RJ45 connector has 8 pins, and each pin needs to be connected with the switch logic, but the switch logic state is consistent.

Under normal circumstances, the switch logic ABCD is in a closed circuit state, and EFG is in an open circuit state, providing the same function as the original network equipment.

In the bypass circuit, the program-controlled chip 101 receives external input conditions, combines the feedback provided by the following technologies to ensure high system availability, and automatically customizes various bypass strategies.

System fault signal provided by watchdog module WatchDog103:

The WatchDog module 103 is connected to the CPU 200 through the bus, and contains a self-checking device inside, which regularly sends an interrupt signal to the CPU. If the CPU fails to process it in time for many times, it can be judged that the system is in a failure stage, and the system failure signal is sent to the program-controlled chip 101.

The power supply 300 provides a power failure fault signal:

When the power supply is cut off, in order to ensure that the bypass circuit can quickly perform bypass switching, the power-off signal will be sent to the program-controlled chip 101, and the program-controlled chip 101 will enable the battery 106 to supply power in time to ensure the signal supply of the high-speed electronic switch integrated chip 102, Bypass control is performed according to preset policies.

The external monitoring device 400 transmits the control signal through the serial port or the USB interface 105

The program-controlled chip 101 also accepts control signals from the external monitoring device 400. When the external firewall and intrusion detection system detect an attack, a command to bypass a certain partition and the black hole partition can be input through the serial port or USB interface 105, so that the network traffic All lead to the black hole to achieve the effect of attack isolation, forming a three-dimensional defense against network attacks.

The physical interface communication signal processing module 104 connects the sending (Tranceive) and receiving (Receive) pins on the physical interface transceiver (PHY) 500 to a special processing module, and judges the fault condition of the network equipment according to the electrical signal of the pins, If there is no electrical signal on the Tranceive pin of a certain PHY interface for a period of time, it can be determined that the MAC chip is faulty, and the program-controlled chip 101 formulates a corresponding bypass strategy based on various conditions.

The program-controlled chip will convert various bypass strategy information into high-speed electronic switch integrated chip control signals, and perform bypass control between any two adjacent interfaces. In this embodiment, the bypass circuit provides the following control commands:

Among them: the value is 1 when the switch logic is closed, and the value is 0 when the switch logic is open

These control commands are latched and processed inside the program-controlled chip, and the control signals are sent to the integrated chip without interruption. In order to ensure that the control state in the high-speed electronic switch integrated chip is not lost when the system is powered off, the bypass circuit uses a battery for backup supply.

The basic principles, main features and advantages of the present utility model have been shown and described above. Those skilled in the art should understand that the utility model is not limited by the above-mentioned embodiments. The above-mentioned embodiments and descriptions only illustrate the principle of the utility model. Without departing from the spirit and scope of the utility model, the utility model The new model also has various changes and improvements, and these changes and improvements all fall within the scope of the claimed utility model. The scope of protection required by the utility model is defined by the appended claims and their equivalents.

Claims (2)

1. the program control bypass protection circuit of a network equipment; it is characterized in that; described protective circuit comprises program control chip; the electronic switch integrated chip; watchdog module; USB interface; physical interface signal of communication processing module and battery; described electronic switch integrated chip connects media interface controller and the physical interface transceiver in the network equipment; described program control chip connects described battery and electronic switch integrated chip; described program control chip connects outer monitoring equipment by USB interface; described program control chip is by the physical interface transceiver in the physical interface signal of communication processing module connection network equipment; described program control chip is by the CPU in the watchdog module connection network equipment, and the power supply in the connection network equipment.

2. the program control bypass protection circuit of a kind of network equipment according to claim 1; it is characterized in that; described electronic switch integrated chip comprises first group of switching logic and second group of switching logic; described first group of switching logic is used for the media interface controller of the network equipment and the connection between the physical interface transceiver, and described second group of switching logic is used for the connection between the physical interface transceiver of the network equipment.

Images