基于飞腾E2000的安全网关设计与实现-《计算机技术与发展》

文章信息/Info

Title:: Design and Implementation of Security Gateway Based on Phytium E2000

Author(s):: HUANG Wu; SHENG Si-hua; TIAN Wei; JIANG Zeng-wen; LI Gang-feng; CEC Industrial Internet Co. ,Ltd. ,Changsha 410006,China

摘要:: 在万物互联的大背景下,实现系统的安全可信始终是最核心的目标。随着国产信息系统建设的不断深入,实现系统的安全可信已经成为最迫切的需求。为了解决工业互联网的多接口数据互联和数据安全问题,设计了一款基于飞腾嵌入式 E2000 处理器的安全网关设备。实现了 3G/ 4G/ 5G 无线 VPN 路由功能,同时支持以太网、RS232 / 485 串口,CAN 口接入,并支持 Wifi/ 蓝牙通信以及 GPS / 北斗定位。通过分析 VLAN 协议原理,基于 RTL8367SC 芯片实现了内置网络交换机功能;融合基于 RG200U 的 5G 模块挂载方法,形成了网关的内置 5G 交换机系统,进一步解决了多通道数据互联的问题。通过分析飞腾安全处理器平台架构规范(Phytium Security Platform Architecture,PSPA),设计了网关的安全可信固件制作方法,保证了启动过程执行的所有代码都是安全可信的。通过搭建测试环境进行测试验证,测试结果表明,该系统实现了多种接口的数据互联,并基于多项 E2000 芯片内置安全加密算法,使安全性方面得到了较大提升。

Abstract:: Under the background of the Internet of everything,to achieve the security and credibility of the system is always the core goal.With the deepening of the construction of domestic information systems,to achieve the security and credibility of the system has become the most urgent demand. In order to solve the problem of multi-interface data interconnection and data security of industrial gateway,a security gateway device based on Phytium embedded E2000 processor is designed. It realizes 3G/ 4G/ 5G wireless VPN routing function,while supporting Ethernet,RS232 / 485 serial port,CAN port access,Wifi / Bluetooth communication and GPS / Beidou positioning. By an-alyzing the principle of VLAN protocol,the function of built-in network switch is realized based on RTL8367SC chip. The 5G module mounting method based on RG200U is integrated to form a built-in 5G switch system of the gateway,which further solves the problem of multi-channel data interconnection. Based on Phytium Security Platform Architecture (PSPA),a method of making secure and trusted firmware of the gateway is designed to ensure that all the code executed during the startup process is safe and trusted. By building a test environment for test and verification,the test results show that the system realizes the data interconnection of multiple interfaces,and based on a number of E2000 chip built-in security encryption algorithms,the security has been greatly improved.