CN107426116B - Integrated security management switch - Google Patents

Integrated security management switch Download PDF

Info

Publication number
CN107426116B
CN107426116B CN201710370363.8A CN201710370363A CN107426116B CN 107426116 B CN107426116 B CN 107426116B CN 201710370363 A CN201710370363 A CN 201710370363A CN 107426116 B CN107426116 B CN 107426116B
Authority
CN
China
Prior art keywords
unit
data
exchange
exchange data
signal
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201710370363.8A
Other languages
Chinese (zh)
Other versions
CN107426116A (en
Inventor
罗玲
王春雨
姚晓峰
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Xin Lian Data Sec Beijing Technology Co ltd
Original Assignee
Xin Lian Data Sec Beijing Technology Co ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Xin Lian Data Sec Beijing Technology Co ltd filed Critical Xin Lian Data Sec Beijing Technology Co ltd
Priority to CN201710370363.8A priority Critical patent/CN107426116B/en
Publication of CN107426116A publication Critical patent/CN107426116A/en
Application granted granted Critical
Publication of CN107426116B publication Critical patent/CN107426116B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00Packet switching elements
    • H04L49/10Packet switching elements characterised by the switching fabric construction
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L49/00Packet switching elements
    • H04L49/40Constructional details, e.g. power supply, mechanical construction or backplane

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Telephonic Communication Services (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

The invention relates to an integrated security management switch, said switch comprising: a switching management unit and a power supply unit; the switching management unit is used for providing an electric signal path between the external node and the designated port, and the power supply unit supplies power to the switching management unit; the exchange management unit includes: an interface unit acquiring original data from an external node; the switching unit converts the original data into first switching data to be transmitted to the storage unit, generates an activation signal and transmits the activation signal to the management unit; a storage unit that receives and stores the first exchange data; the management unit inquires the first exchange data according to the activation signal and determines whether the first exchange data is safety data or not; the security unit receives the first exchange data, performs security check calculation on the first exchange data, and returns calculation result data to the management unit; the management unit generates second exchange data according to the calculation result data and the first exchange data, and forwards the second exchange data to the designated port through the exchange unit and the interface unit.

Description

Integrated security management switch
Technical Field
The invention relates to the technical field of switches, in particular to an integrated security management switch.
Background
The construction of a safe and reliable information network is an important work in the thirteen-five project. The safety and control design scheme of the existing network mainly carries out safety and credibility control from service nodes (between application suppliers and service platforms and between service platforms and users) such as storage, servers, service chains, mobile equipment and the like.
The trusted control of the service nodes is to satisfy the integrity and the confidentiality of the service data, provided that the data received or transmitted by each service node is not itself stolen or destroyed. This requires that similar data leakage events be prevented and stopped at the network transport switching layer. The current network construction scheme does not pay enough attention to the security management of the network transmission and exchange layer.
From the major security events such as 'snood prism gate' and 'heart blood leak', we can know that the back door firmware based on the network transmission switching equipment causes data leakage to be one of the important ways for other party to collect research or tamper with and destroy the information of our machine and influence the execution of our normal business.
Disclosure of Invention
Aiming at the defects of the prior art, the invention provides an integrated security management switch, which adopts an autonomous controllable equipment mode of adding a security unit to physically isolate the switch so as to prevent malicious codes from attacking the whole network, so that the equipment level of the bottom data transmission and exchange is safely reinforced, and the stability and the safety of the whole network service are ensured. The integrated security management switch provided by the embodiment of the invention provides technical support for the whole network service, weakens the participation of upstream equipment manufacturers on the network management level, and reduces the management difficulty and risk.
To achieve the above object, the present invention provides an integrated security management switch, comprising:
the switching management unit is used for providing an electric signal path between an external node of the switching management unit and the designated port; the exchange management unit includes:
an interface unit for connecting the external node and the designated port;
the interface unit obtains the port address of the designated port according to the request signal sent by the designated port, and obtains the original data from the external node;
the exchange unit is connected with the interface unit, converts the original data into first exchange data, transmits the first exchange data to the storage unit, generates an activation signal and sends the activation signal to the management unit;
the storage unit is connected with the exchange unit and used for receiving and storing first exchange data;
the management unit is respectively connected with the storage unit and the exchange unit, and inquires the first exchange data according to the activation signal to determine whether the first exchange data is safety data; generating a check signal when the first exchange data is determined to be the security data, and transmitting the first exchange data to the security unit;
the safety unit is connected with the management unit, receives the first exchange data, performs safety check calculation on the first exchange data according to the check signal to obtain calculation result data, and returns the calculation result data to the management unit;
the management unit generates second exchange data according to the calculation result data and the first exchange data, generates a calling signal and sends the calling signal to the exchange unit;
the switching unit acquires second switching data according to the calling signal, sends the second switching data to the interface unit, and forwards the second switching data to the designated port through the designated port address acquired by the interface unit;
the power supply unit is electrically connected with the interface unit, the exchange unit, the storage unit, the management unit and the safety unit respectively and supplies power to the interface unit, the exchange unit, the storage unit, the management unit and the safety unit.
Preferably, the interface unit comprises an interface terminal and a converter;
the interface end is connected with the external node and the designated port and is used for transmitting data with the external node and the designated port;
the converter converts an external signal of the external node into original data.
Preferably, the security unit comprises: the device comprises a processor, an input/output interface and a memory;
the input/output interface is connected with the management unit and is used for receiving the check signal and the first exchange data and outputting calculation result data;
the memory is connected with the input/output interface and used for storing first exchange data;
the processor is connected with the memory and calculates to obtain calculation result data according to the first exchange data.
Further preferably, the processor calculates, according to the first exchange data, calculation result data specifically including: and the processor performs security check calculation on the first exchange data according to a security rule preset by the application layer, and generates calculation result data.
Preferably, the management unit generates the second exchange data according to the calculation result data and the first exchange data specifically includes: the management unit generates second exchange data according to the calculation result data and the first exchange data, and sends the calculation result data and the second exchange data to the storage unit.
Preferably, the management unit generates a call signal and sends the call signal to the switching unit, and the switching unit obtains the second switching data according to the call signal specifically: the management unit generates a calling signal and sends second exchange data to the storage unit; the exchange unit acquires the second exchange data from the storage unit according to the call signal.
Preferably, the integrated security management switch further comprises a signal light;
the signal lamp comprises a signal lamp interface;
the signal lamp interface is connected with the interface unit and drives the signal lamp to flash according to the request signal.
The security unit in the integrated security management switch provided by the embodiment of the invention can independently complete processing independently of the management unit, so that malicious firmware cannot acquire and crack the algorithm logic in the security unit. In addition, the integrated security management switch provided by the embodiment of the invention is realized in a whole machine integrated mode, so that the integrated security management switch is convenient for mass production, unified management and maintenance.
Drawings
Fig. 1 is a schematic diagram of an integrated security management switch according to an embodiment of the present invention.
Detailed Description
The technical scheme of the invention is further described in detail through the drawings and the embodiments.
Fig. 1 is a schematic diagram of an integrated security management switch provided in an embodiment of the present invention, and as shown in fig. 1, the integrated security management switch provided in the embodiment of the present invention includes a switch management unit 1 and a power supply unit 2. Wherein the exchange management unit 1 comprises: an interface unit 11, a switching unit 12, a storage unit 13, a management unit 14, a security unit 15 and a beacon 16.
The power supply unit 2 is electrically connected to the interface unit 11, the exchange unit 12, the storage unit 13, the management unit 14, the security unit 15 and the signal lamp 16, respectively, and supplies power to the interface unit 11, the exchange unit 12, the storage unit 13, the management unit 14, the security unit 15 and the signal lamp 16.
The interface unit 11 is connected to a connection external node and a designated port. The external node is a data input end of one service node, the designated port is a data receiving end of the other service node, and the external node and the designated port realize data exchange through an electric signal channel provided by the integrated security management switch. The interface unit 11 acquires the port address of the specified port according to the request signal sent from the specified port, and acquires the original data from the external node.
Specifically, the interface unit 11 includes an interface terminal 111 and a converter 112. The interface terminal 111 connects the external node and the designated port, and is configured to receive a request signal sent by the designated port, obtain a port address of the designated port and an external signal of the external node, and send the external signal to the converter 112. The converter 112 converts the received external signal of the external node into the original data that can be read by the switching unit 12, and then returns the original data to the interface terminal 111. This allows for the unified integration of the data formats in the security management switch for data exchange between the individual units.
In order to facilitate the user to observe the connection work of the communication link, the exchange management unit 1 provided in the present invention further comprises a signal lamp 16. The signal lamp 16 has a signal lamp interface 161, and is connected to the interface unit 11 through the signal lamp interface 161. The signal lamp 16 performs a regular "light-dark" flashing action to indicate the port operation. Specifically, the signal light interface 161 obtains a request signal through the interface terminal 111, and drives the signal light 16 to flash.
The switching unit 12 is connected to the interface unit 11 and the storage unit 13, where the switching unit 12 receives the original data sent by the interface unit 11, extracts the original data information, converts the original data into first switching data, and forwards the first switching data to the storage unit 13, and after the storage unit 13 receives and stores the first switching data, the switching unit 12 generates an activation signal and sends the activation signal to the management unit 14 to activate the management unit 14 to work. The first exchange data may be description type data of positioning, quantitative, qualitative or timing, or may be cipher type data carrying identity information.
The management unit 14 is connected to the storage unit 13 and the exchange unit 12, and after receiving the activation signal, the management unit 14 queries the data information of the first exchange data to determine whether the first exchange data is security data. The term security data is understood here to mean non-generic data which requires security checking and processing.
If the first exchange data is not secure data, the management unit 14 generates a first call signal. The switching unit 12 retrieves the first switching data from the storage unit 14 according to the first call signal and sends the first switching data to the interface unit 11. The interface unit 11 receives the first switching data, and transmits the first switching data to the designated port according to the port address of the designated port, thereby completing the data switching process.
If the first exchange data is security data, that is, if security check calculation and processing are required for the first exchange data, the management unit 14 generates a check signal, receives the first exchange data according to the check signal, and transmits the first exchange data to the security unit 15. The security unit 15 receives the first exchange data according to the check signal, performs security check calculation on the first exchange data, and returns calculation result data to the management unit 14 after the calculation is completed.
When the first exchange data is security data, the security check calculation of the security unit 15 may be specifically described as follows.
In the specific implementation provided in this embodiment, the security unit 15 includes an input-output interface 151, a memory 152, and a processor 153.
The input/output interface 151 is connected to the management unit 14, and is configured to receive the inspection signal and the first exchange data, and send the first exchange data to the memory 152. The memory 152 is connected to the input/output interface 151 for storing the first exchange data. The processor 153 is connected to the memory 152, reads the first exchange data in the memory 152, and performs security check calculation on the first exchange data. After the security check is completed, the processor 153 sends the calculation result data to the memory 152 for data storage, and simultaneously sends the calculation result data to the management unit 14 through the input/output interface 151.
The security unit 15 is a computing module independently loaded in the integrated security management switch having an independent memory 152 and an independent processor 153, such architecture enabling the security unit 15 to store the first exchange data and the computation result data independently without sharing with other chip memory and/or storage in the integrated security management switch. The hardware logic provides physical isolation to prevent malicious code from attacking the security element 15.
In a specific example, an operating system (hereinafter referred to as a host computer operating system) of the integrated security management switch provided in the embodiment of the present invention has a software development kit (Software Development Kit, SDK) for the security unit 15, driver software for the security unit 15, and management software for production release and application control for the security unit 15.
The SDK is interface software of the upper computer operating system to the security unit 15, and mainly realizes functions of communication establishment, use authentication, instruction interaction, communication termination and the like of the upper computer operating system and the security unit 15. The SDK provides all the functions in a mode of application programming interfaces (Application Programming Interface, APIs), and supports a WINDOWS system, a LINUX system and an Android system according to the type of an upper computer operating system. The core modules comprise an SDK instruction line mode, an SDK channel management, an SDK use management, a security unit 15 operating system instruction set, a security unit 15 communication instruction set, an upper computer operating system version management and the like.
The driver software links the host operating system to the security unit 15 so that the security unit 15 can run on the host operating system.
The management software is upper computer desktop application software for connecting and operating the security unit 15. Mainly providing functions of installing and upgrading the security unit 15. The management software mainly comprises: the system comprises a bottom layer communication module, a user interface design, a security management module, a software period management module, a script analysis (script grammar checking, instruction analysis and batch processing), an algorithm verification module, a data encryption and decryption module, an authentication management module and the like.
For the security unit 15 itself, a separate operating system (hereinafter referred to as sub-operating system) and a separate application function module are employed.
The sub operating system manages the storage of the memory 152 in the secure unit 15 and the computation of the processor 153, and provides a set of execution instructions for the input-output interface 151 to receive the first exchange data and return the computation result data to the management unit 14. The processor 153 performs security check calculation on the first exchange data according to a security rule preset by an application layer of the sub-operating system, and generates the calculation result data. That is, the sub-operating system provides secure operation capability for independent operations and storage with the memory 152 and processor 153 of the secure management unit 15 independent.
The application function module of the sub operating system comprises: the input/output interface 151 drives, the processor 153 drives, the memory 152 reads the core sub-modules such as the drive, the sub-operating system management module, the application (patch) loading module, the algorithm family module, the data encryption and decryption module, the authentication management module, the application life cycle management module and the like.
The application function module is an application program for realizing security check calculation and data transmission by the processor 153, and the processor 153 is only in butt joint with the management unit 14 through the memory 152 and the input-output interface 151, so that the application function module can independently complete configuration and management work of the security unit 15. And the application function module is in an encryption mode for the transmission mode of the first exchange data so as to prevent the firmware of the upper computer operating system from illegal interception.
In terms of software logic, the integrated security management switch architecture enables internal operation management of the security unit 15 not to be clamped by an upper operating system, weakens participation of upper equipment manufacturers on a network management level, and reduces management difficulty and risk.
When the security unit 15 completes the security check calculation, the management unit 14 generates second exchange data from the calculation result data and the first exchange data, and transmits the calculation result data and the second exchange data to the storage unit 13.
Compared with the first exchange data, the second exchange data is subjected to security check calculation to remove possible malicious codes in the first exchange data, and transmission communication encryption and identity authentication are carried out on the first exchange data, so that the second exchange data is prevented from being tampered or stolen in the transmission process.
After the storage unit 13 performs backup storage of the calculation result data and the second exchange data, the management unit 14 generates a call signal. The switching unit 12 acquires the second switching data from the storage unit 14 according to the call signal, and transmits the second switching data to the interface unit 11. The interface unit 11 receives the second switching data and transmits the second switching data to the designated port according to the port address of the designated port, thereby completing the data switching process between the external node and the designated port.
The integrated security management switch provided by the embodiment of the invention adopts an independent controllable equipment mode of additionally installing the security unit to physically isolate the switch so as to prevent malicious codes from attacking the whole network, so that the equipment level security of the bottom data transmission and exchange is reinforced, and the stability and the security of the whole network service are ensured. In addition, the integrated security management switch provided by the embodiment of the invention is realized in a whole machine integrated mode, and all units in the exchange management unit are integrated on one board card, so that the integrated security management switch is convenient for mass production and unified management and maintenance.
Those of skill would further appreciate that the various illustrative elements and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative elements and steps are described above generally in terms of function in order to clearly illustrate the interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied in hardware, in a software module executed by a processor, or in a combination of the two. The software modules may be disposed in Random Access Memory (RAM), memory, read Only Memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
The foregoing description of the embodiments has been provided for the purpose of illustrating the general principles of the invention, and is not meant to limit the scope of the invention, but to limit the invention to the particular embodiments, and any modifications, equivalents, improvements, etc. that fall within the spirit and principles of the invention are intended to be included within the scope of the invention.

Claims (5)

1. An integrated security management switch, the switch comprising:
a switching management unit for providing an electrical signal path between an external node of the switching management unit and a designated port; the exchange management unit comprises an interface unit, an exchange unit, a storage unit, a management unit and a safety unit;
the interface unit is used for connecting the external node and the appointed port;
the interface unit obtains a port address of the designated port according to a request signal sent by the designated port, and obtains original data from the external node;
the exchange unit is connected with the interface unit, converts the original data into first exchange data, transmits the first exchange data to the storage unit, and generates an activation signal to be sent to the management unit;
the storage unit is connected with the exchange unit and used for receiving and storing the first exchange data;
the management unit is respectively connected with the storage unit and the exchange unit, and inquires the first exchange data according to the activation signal to determine whether the first exchange data is safety data; generating a check signal and transmitting the first exchange data to the security unit when the first exchange data is determined to be the security data;
the safety unit is connected with the management unit, receives the first exchange data, performs safety check calculation on the first exchange data according to the check signal to obtain calculation result data, and returns the calculation result data to the management unit;
the management unit generates second exchange data according to the calculation result data and the first exchange data, generates a calling signal and sends the calling signal to the exchange unit;
the exchange unit acquires the second exchange data according to the call signal, sends the second exchange data to the interface unit, and forwards the second exchange data to a designated port through the designated port address acquired by the interface unit;
the power supply unit is electrically connected with the interface unit, the exchange unit, the storage unit, the management unit and the safety unit respectively and supplies power to the interface unit, the exchange unit, the storage unit, the management unit and the safety unit;
the security unit includes: the device comprises a processor, an input/output interface and a memory;
the input/output interface is connected with the management unit and is used for receiving the check signal and the first exchange data and outputting the calculation result data;
the memory is connected with the input/output interface and used for storing the first exchange data;
the processor is connected with the memory, and calculates the calculation result data according to the first exchange data;
the management unit generates a call signal and sends the call signal to the switching unit, and the switching unit obtains second switching data according to the call signal specifically:
the management unit generates a calling signal and sends the second exchange data to the storage unit; and the exchange unit acquires the second exchange data from the storage unit according to the call signal.
2. The switch of claim 1, wherein the interface unit comprises an interface terminal and a converter;
the interface end is connected with the external node and the designated port and used for transmitting data with the external node and the designated port;
the converter converts an external signal of the external node into original data.
3. The switch according to claim 1, wherein the processor calculates the calculation result data according to the first switching data specifically as follows:
and the processor performs security check calculation on the first exchange data according to a security rule preset by an application layer, and generates calculation result data.
4. The switch according to claim 1, wherein the management unit generates second switching data from the calculation result data and the first switching data specifically is:
the management unit generates second exchange data according to the calculation result data and the first exchange data, and sends the calculation result data and the second exchange data to the storage unit.
5. The switch of claim 1, wherein the integrated security management switch further comprises a signal light;
the signal lamp comprises a signal lamp interface;
the signal lamp interface is connected with the interface unit, and drives the signal lamp to flash according to the request signal.
CN201710370363.8A 2017-05-23 2017-05-23 Integrated security management switch Active CN107426116B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201710370363.8A CN107426116B (en) 2017-05-23 2017-05-23 Integrated security management switch

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201710370363.8A CN107426116B (en) 2017-05-23 2017-05-23 Integrated security management switch

Publications (2)

Publication Number Publication Date
CN107426116A CN107426116A (en) 2017-12-01
CN107426116B true CN107426116B (en) 2023-11-07

Family

ID=60428546

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201710370363.8A Active CN107426116B (en) 2017-05-23 2017-05-23 Integrated security management switch

Country Status (1)

Country Link
CN (1) CN107426116B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109814406B (en) * 2019-01-24 2021-12-24 成都戴瑞斯智控科技有限公司 Data processing method and decoder framework of track model electronic control simulation system

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101013962A (en) * 2006-02-06 2007-08-08 飞塔信息科技(北京)有限公司 Integrated security switch
US7412722B1 (en) * 2002-08-08 2008-08-12 Verizon Laboratories Inc. Detection of softswitch attacks
CN101447999A (en) * 2008-10-31 2009-06-03 神州数码金程(北京)科技有限公司 Security exchange system and realization method thereof
CN205304860U (en) * 2016-01-13 2016-06-08 北京安信极联信息科技有限公司 Safe data interchange machine system that uses

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7412722B1 (en) * 2002-08-08 2008-08-12 Verizon Laboratories Inc. Detection of softswitch attacks
CN101013962A (en) * 2006-02-06 2007-08-08 飞塔信息科技(北京)有限公司 Integrated security switch
CN101447999A (en) * 2008-10-31 2009-06-03 神州数码金程(北京)科技有限公司 Security exchange system and realization method thereof
CN205304860U (en) * 2016-01-13 2016-06-08 北京安信极联信息科技有限公司 Safe data interchange machine system that uses

Also Published As

Publication number Publication date
CN107426116A (en) 2017-12-01

Similar Documents

Publication Publication Date Title
US9191388B1 (en) Trusted security zone communication addressing on an electronic device
US11334510B1 (en) Systems and methods for combination write blocking with connection interface control devices
US10244392B2 (en) Over-the-air personalization of network devices
US20180165673A1 (en) NFC-Enabled Devices for Performing Secure Contactless Transactions and Using HCE
US11829478B2 (en) Full server recovery architecture for cloud bare metal instances
CN106055502A (en) Universal serial bus (usb) filter hub
CN104573435A (en) Method for terminal authority management and terminal
US9860218B2 (en) Information processing terminal, information processing method, and information processing system
US20160044498A1 (en) Host device coupled to a mobile phone and method of operating the same
CN110381075B (en) Block chain-based equipment identity authentication method and device
US20210192086A1 (en) Virus immune computer system and method
CN103646198A (en) Method, system and device for locking working region of mobile terminal
CN103973715B (en) Cloud computing security system and method
EP3462305A1 (en) Ecu and peripherals update using central dispatch unit
US20210382985A1 (en) Virus immune computer system and method
CN111125707A (en) BMC (baseboard management controller) safe starting method, system and equipment based on trusted password module
US11256494B2 (en) ECU and peripherals update using central dispatch unit
CN107426116B (en) Integrated security management switch
CN110351130B (en) Equipment information management method, device and system
CN104796532A (en) Method and device for destroying mobile terminal
CN106982233B (en) Integrated security management switch with discrete power supply
CN106982232B (en) Discrete security management switch
CN106992947B (en) Safety management switch with separated power supply
CN109740351A (en) A kind of leak detection method, device and the equipment of embedded firmware
CN115146284A (en) Data processing method and device, electronic equipment and storage medium

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant