基于FPGA的千兆网络安全通信研究与实现

发布时间：2019-06-13 22:29

【摘要】：计算机技术的发展,带来的是各种数据量的暴增,而大量数据如何进行稳定快速并且安全的传输已经成为了当今研究的热点。伴随着各种嵌入式技术的发展,安全千兆以太网的设计形式也多种多样。从最简单的单片机,到需要较复杂的嵌入式软件编程的ARM处理器,再到基于硬件逻辑的FPGA,都可以实现安全的千兆以太网功能。在一系列的实现方式中,FPGA由于其集成度高、并行性设计、设计灵活性等特点在小型化设备的设计中有独特的优势。论文介绍了一种基于FPGA的安全千兆以太网的设计方法。采用软硬件协同的设计方式,利用FPGA逻辑设计完成安全千兆以太网的硬件平台搭建,并结合FPGA嵌入式软件部分,最终实现数据的加密传输。文中首先介绍了设计中所使用到的技术理论基础,包括FPGA的内部结构特点、AES算法的实现基础和具体结构以及所使用到的精简TCP/IP协议栈模型。并且对所使用到的MAC控制器和PHY芯片进行了深入的研究。在此基础上,设计了基于MAC控制器的自定义数据链路层IP核,采用自定义异步AXI-FIFO的方式保证在跨时钟域传输的过程中,数据的完整性和可靠性。为了保证数据的安全性,系统中采用自定义AES算法IP核。为了保证AES算法加解密的密钥安全性,结合FPGA硬件设计的特点,使用振荡器产生真随机数作为加解密密钥;为了节省FPGA的逻辑资源,采用模块复用的方式,将AES加密与解密模块进行了统一的处理。在完成关键硬件模块设计的基础上,对LWIP的源码进行移植,并且针对设计需要,对底层网络接口相关代码进行了重新的设计。在应用层,设计实现自定义的数据接收与发送函数,并对接收到的数据打印校验。最后,为了系统调试方便,先对硬件模块进行模块化测试,针对自定义IP核测试时,通过设计TestBech测试用例,自定义产生所要发送的数据。自定义IP核测试成功之后,再进行系统的板级测试。通过板级测试,证明本文所设计的千兆以太网可以实现数据的加密传输;通过分析FPGA内部的资源损耗情况,可以得到该设计没有使用到任何特殊的嵌入式IP核,并且明显的减少了FPGA内部逻辑资源的消耗。
[Abstract]:The development of computer technology has brought about the sudden increase of all kinds of data, and how to transmit a large number of data stably, quickly and safely has become the focus of current research. With the development of various embedded technologies, the design forms of secure Gigabit Ethernet are also various. From the simplest single chip microcomputer to the ARM processor which needs more complex embedded software programming, to the FPGA, based on hardware logic, the secure Gigabit Ethernet function can be realized. Among a series of implementation methods, FPGA has unique advantages in the design of miniaturized equipment because of its high integration, parallelism design, design flexibility and so on. This paper introduces a design method of secure Gigabit Ethernet based on FPGA. The hardware platform of secure Gigabit Ethernet is designed by using FPGA logic, and the encryption transmission of data is realized by combining the embedded software part of FPGA. In this paper, the technical theoretical basis used in the design is introduced, including the internal structure characteristics of FPGA, the implementation basis and concrete structure of AES algorithm, and the simplified TCP/IP protocol stack model used. The MAC controller and PHY chip are deeply studied. On this basis, a custom data link layer IP core based on MAC controller is designed, and the custom asynchronous AXI-FIFO is used to ensure the integrity and reliability of the data in the process of cross-clock domain transmission. In order to ensure the security of the data, the custom AES algorithm IP core is used in the system. In order to ensure the key security of AES algorithm encryption and decryption, combined with the characteristics of FPGA hardware design, the oscillator is used to generate true random numbers as encryption and decryption keys. In order to save the logic resources of FPGA, the AES encryption and decryption modules are processed uniformly by module reuse. On the basis of completing the design of the key hardware module, the source code of LWIP is ported, and the code related to the underlying network interface is redesigned according to the design needs. In the application layer, a custom data receiving and sending function is designed and implemented, and the received data is printed and verified. Finally, in order to debug the system conveniently, the hardware module is tested modularize. When the custom IP core test case is designed, the TestBech test case is designed to generate the data to be sent. After the custom IP core test is successful, then the board level test of the system is carried out. Through board level test, it is proved that the Gigabit Ethernet designed in this paper can realize the encrypted transmission of data, and by analyzing the resource loss in FPGA, we can get that the design does not use any special embedded IP core, and obviously reduces the consumption of logic resources in FPGA.
【学位授予单位】：杭州电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.11

【相似文献】