CN100496050C - Wireless protection access equipment based on embedded system - Google Patents

Abstract

The device includes three modules: platform module of minimum embedded system, I/O expandable communication module and software system module. In realization of hardware, the invention puts forward new method for designing structure and realization. Features of the invention are: realizing WEP, TKIP, AES, dynamic updating cryptographic key, WPA standard, and first time in domestic for supporting WPA2/IEEE802.11i standard; supporting 802.1x standard based each EAP safety authentication mode; realizing access control for MAC address from users, isolation in two layers for users, possessing functions for managing network addresses including DHCP, NAT; supporting local network management and remote security network management functions.

Description

Wireless protection access equipment based on embedded system

technical field

The invention relates to a wireless protection access device in the field of wireless network communication, which adopts an embedded processor MPC852 as a basic platform, and is a wireless protection access device based on an embedded system.

Background technique

Wireless local area network (Wireless Local Area Network, WLAN) is the application of modern wireless communication technology in the computer network with rapid development. And multimedia applications provide the means of realization. With the development of personal data communication, powerful portable data terminals and multimedia terminals have been widely used. In order to realize the goal that anyone can perform data communication at any time and any place, the traditional computer network is required to develop from wired to wireless, from fixed to mobile, and from single service to multimedia service. The wireless local area network technology that meets this demand is therefore received widespread attention. With its advantages of convenience, speed, and low cost, wireless local area network has achieved considerable development and great success in the application of enterprises and public hotspots. requirements are getting higher and higher.

Wireless Internet is more vulnerable to security threats than wired Internet due to:

Openness: The wireless transceiver of the wireless local area network often adopts the omnidirectional antenna. Information is sent to the open space. Different from the fixed physical boundary of wired LAN, the information boundary of wireless LAN is open and uncertain, so it is more likely to cause information leakage and be attacked by unauthorized access to information.

Mobility: WLAN terminals can be moved. Whether it is walking or roaming, its physical location is uncertain, so the route is also uncertain.

Efficient implementation of security mechanisms: The bandwidth of a wireless LAN is usually much smaller than that of a wired network. The requirements of low power consumption, low cost, and small size of mobile terminals impose strict requirements on the security mechanism of mobile terminals in WLAN.

Although the existing WLAN uses direct sequence spread spectrum (DSSS) and frequency hopping spread spectrum (FHSS) for anti-jamming spread spectrum technology, and IEEE 802.11 has also formulated the Wired Equivalent Privacy (WEP) protocol, but it still cannot meet some requirements. User's security requirements for WLAN. The security loopholes in the 1999 version of IEEE 802.11 standards have been recognized internationally, and have seriously threatened the further application of wireless LAN standards. For this reason, research on WLAN security technology has become one of the most active research fields in the current international WLAN new standard formulation work. Internationally, the Wi-Fi Alliance has proposed a new security standard to enhance the security performance of WLAN, which is called Wireless Protected Access (WPA). The basic idea is to use IEEE802.1x access authentication protocol plus Temporal Key Integrity Protocol (TKIP) as a solution for information security. 802.11i is an IEEE802.11 security enhancement protocol formulated by IEEE, which was approved by the Standards Committee of the Institute of Electrical and Electronics Engineers (IEEE) in June 2004. It consists of two parts: one to improve existing 802.11 devices that use current algorithms; the other to add new capabilities to 802.11 devices to support the encryption algorithm of the Advanced Encryption Standard (AES). WPA2 is the second-generation WPA standard released by the Wi-Fi Alliance, which is compatible with the first-generation WPA standard. The characteristics of 802.11i and WPA2 are basically the same, and their most important characteristics are pre-authentication: realizing safe and fast roaming without users noticing the delay, and using CCMP encryption package instead of TKIP. AES can produce the high level of data privacy required by some enterprises, government departments and other institutions. CCMP is an AES-based encryption mechanism that is mandatory in 802.11i and WPA2, and pre-authentication is optional.

At present, the security mechanism of IEEE802.11X cannot provide a strong security protection mechanism. To make up for the security flaws of IEEE802.11X. Each manufacturer proposes its own solution. The 802.11TGi working group is also engaged in the development of new security mechanisms. One is to completely abandon RC4 and build a new security system based on the latest AES algorithm. Although the security is higher in this way, the workload is relatively large, and it is not compatible with the original products, so it can be used as a long-term solution; in addition, it is to improve its shortcomings on the basis of the existing WEP protocol. Try to provide a short-term solution through software upgrades. So that tens of millions of sets of 802.11 equipment sold all over the world will not be eliminated immediately. Regardless of the scheme, new security protocols are introduced to enhance security performance.

In the way of realizing the wireless protection access, the known method is to realize it by utilizing the relevant chipsets (Chipsets) of the wireless local area network in foreign countries. At present, foreign manufacturers that provide WLAN implementations mainly include chip sets from companies such as Intersil, Atmel, and Atheros. In the prior art, the implementation of chip sets generally consists of a MAC layer processor module, a physical layer hardware module, and a firmware module integrating MAC layer protocol functions. Due to the firmware modularization of the MAC layer protocol functions, the system update port is not open. Thereby, on the implementation mode of above known wireless protection access, some following shortcomings have been reflected: 1, lack of expansibility, because the relevant standard of wireless local area network is in the middle of constant revision, the security of known wireless local area network now The characteristics of performance and multimedia support need to be improved. The off-the-shelf set of chips cannot complete the wireless protection access function, and the existing hardware equipment must be updated. 2. Lack of flexibility. Since the encryption algorithm is solidified in the chip, it is obviously difficult to implement the implementation method of the chip when implementing one's own security algorithm on the wireless protection access device.

Contents of the invention

Technical problem: The purpose of the present invention is to provide a wireless protection access device based on an embedded system, which overcomes the above-mentioned shortcomings of wireless access, and realizes scalable and flexible wireless local area network protection access.

Technical solution: The wireless protection access device based on an embedded system of the present invention includes three parts: a minimum embedded system hardware platform, an I/O expansion communication module and a software system module. in,

1. the embedded system platform hardware module of the present invention mainly comprises following several submodules:

1) An embedded processor and its supporting circuit sub-modules: MPC852T has at least an SPI interface for control and an SCC interface for data communication.

2) Memory module circuit: at least one synchronous dynamic random access memory and one flash memory chip.

3) Power module circuit: the power supply end is provided with a plurality of power filter capacitors to effectively filter out power ripple.

4) Reset and hardware initialization module: generate software and hardware reset signals.

5) Clock module circuit: provide different clock options for on-chip and peripherals.

6) BDM debugging interface module: used for hardware debugging and program upgrade, etc.

2. The I/O expansion communication module is composed of four parts: 10M/100M Fast Ethernet communication module circuit, 10M Ethernet communication module circuit, serial communication module circuit and wireless communication module.

1) 10M/100M self-adaptive Ethernet communication module: provide communication interface with Fast Ethernet;

2) 10M Ethernet communication module: provide communication interface with Ethernet;

3) Serial communication module: serial interface for local system configuration.

4) Wireless communication module: composed of Intersil PRISM2.5 chipset and corresponding peripheral circuits, used for wireless data transmission and reception.

3. The software system modules of this wireless protection access device include:

a) Embedded LINUX operating system software platform: provide a basic system support platform for the realization of other module functions;

b) Ethernet driver module: realize Ethernet interface driver, capable of Ethernet data communication;

c) Serial port driver module: realize RS232 serial port driver, and can perform local configuration function on the system through the serial port;

d) PCMCIA driver module: realize PCMCIA bus data transmission and control;

e) Wireless access hardware driver module: realize the hardware driver based on 802.11b wireless access module;

f) WEP encryption module: realize WEP encryption of communication data packets;

g) TKIP encryption module: realize TKIP encryption of communication data packets;

h) AES encryption module: realize AES encryption of communication data packets;

i) Network bridge device driver module: realize the bridging function with the Ethernet interface.

j) MAC layer protocol stack software module Other modules also include IEEE802.1x authentication module, SNMP/HHTP/CLI remote network management module, local serial port module: mainly complete the authentication management of MAC layer protocol defined by IEEE802.11, key negotiation, IEEE802 .1x, remote network management, local system configuration and other management functions.

The embedded processor U1 is electrically connected to a readable and writable memory circuit and a flash memory circuit through data, address and control lines respectively, and is also electrically connected to a storage auxiliary circuit through a data line; the embedded processor U1 is also electrically connected to There are power supply circuit, reset and hardware initialization circuit, clock circuit, and BDM debugging interface circuit, which together constitute a minimum embedded system platform module; embedded processor U1 is also connected to 10/100M fast Ethernet interface through control data line circuit, 10M Ethernet interface circuit and serial interface circuit, and these interface circuits are respectively connected to the Ethernet interface and serial interface through interface lines; the embedded processor U1 is connected to the wireless access module circuit through a standard PCMCIA interface socket; these components An I/O expansion communication module with multiple communication forms; the embedded processor U1 and each communication sub-module complete the communication connection and communication cooperation process through the corresponding driver module and MAC software protocol stack.

Each driving module of the present invention is written in a dynamic module loading manner.

The wireless protection access device based on the embedded system of the present invention has achieved good functional characteristics: it has realized functions such as 802.11 wireless local area network access and network bridge, and has the characteristics of scalability and flexibility at the same time, which is convenient for future upgrades and expansions; The invention device also enhances the function of the access point by adding corresponding functional modules in the MAC layer protocol stack: adding 802.1x-based authentication, TKIP encryption algorithm, AES encryption algorithm and dynamic key management methods to enhance wireless access In order to realize the security of access in the wireless local area network. In addition, other related algorithms that enhance the performance of supporting multimedia transmission can also be added to the product of the present invention, thereby realizing a good wireless protection access device supporting multimedia communication.

The wireless protection access device based on the embedded system proposed by the present invention, on the one hand, complies with the IEEE international standard, and realizes the basic wireless local area network access function specified in the standard; on the other hand, it also provides an expandable and flexible interface, which is convenient for future The version upgrade can increase and enhance encryption algorithm, fast authentication algorithm and support QoS service mechanism to realize safe, efficient and wireless protection access equipment that supports multimedia communication; in addition, after the system is built, by writing corresponding software or in hardware With a slight modification on the above, the platform can be transformed into other communication products, such as wireless bridges, routers, T1/E1 communication platforms, etc., and there are still relatively wide application prospects.

Description of drawings

The system architecture diagram of Fig. 1 equipment of the present invention;

The total circuit schematic diagram of Fig. 2 equipment of the present invention;

The software and hardware module relationship diagram of Fig. 3 equipment of the present invention;

The electrical schematic diagram I-minimum embedded system platform of Fig. 4 equipment of the present invention;

The electrical principle diagram II-I/O expansion wired communication part of Fig. 5 equipment of the present invention;

The electrical principle diagram III-I/O expansion wireless communication part of Fig. 6 equipment of the present invention;

The software system state diagram of Fig. 7 equipment of the present invention;

Fig. 8 is a software flowchart of the MAC layer protocol stack of the device of the present invention.

Detailed ways

The device of the invention is a wireless protection access device based on an embedded system. The structure and flow of each module of the device of the present invention will be described in detail below in conjunction with the accompanying drawings.

The system architecture shown in Figure 1 shows that the access device mainly includes three parts: the minimum embedded system hardware platform module 1, the I/O expansion communication module 2 and the software system module 3. Among them, the minimum embedded system hardware platform module 1 part includes embedded processor MPC852T and its supporting circuit 4, memory module circuit 5, power supply module circuit 6, reset and hardware initialization module 7, clock module circuit 8 and BDM debugging interface module circuit 9. The I/O expansion communication module 2 is further divided into a wired communication interface and a wireless communication interface. The former includes a 10M/100M Fast Ethernet interface module circuit 10, a 10M Ethernet interface module circuit 11 and a serial interface module circuit 12; The latter is to comprise MAC and baseband processing circuit 13, intermediate frequency processing circuit 14, radio frequency processing circuit 15, radio frequency power amplifier circuit 16 and antenna module 17; Software system module 3 is made of embedded LINUX operating system software platform 18, Ethernet drive module 19, Serial port driver module 20, PCMCIA driver module 21, wireless access hardware driver module 22, WEP encryption module 23, TKIP encryption module 24, AES encryption module 25, bridge device driver module 26 and 802.1x authentication management module 27, SNMP/HTTP /CLI remote network management module 28 and local serial port module 29.

Figure 2 shows the general circuit principle of the wireless protection access device based on the embedded system of the present invention. It can be seen that the embedded processor U1 is electrically connected to a readable and writable memory circuit 30 and a flash memory circuit 31 through data, address and control lines 33 and 34 respectively, and is also electrically connected to a storage auxiliary circuit 32 through a data line 35; In addition, the embedded processor U1 is also electrically connected to a power supply circuit 6, a reset and hardware initialization circuit 7, a clock circuit 8, and a BDM debugging interface circuit 9, which together constitute a minimum embedded system platform. Embedded processor U1 is also connected with 10/100M Fast Ethernet interface circuit 10, 10M Ethernet interface circuit 11 and serial interface circuit 12 respectively through control data lines 36, 37, 38, and these interface circuits are respectively connected through interface lines 42 , 43, 44 are correspondingly connected to the Ethernet interface 39, 40 and the serial interface 41; the embedded processor U1 is connected to the wireless access module circuit 45 through the standard PCMCIA interface socket 46; these constitute an I/O expansion with multiple communication forms communication module. There are corresponding drive modules and MAC software protocol stacks between the embedded processor U1 and each communication sub-module to complete the communication connection and communication cooperation process.

The data transmission process of the wireless protection access device based on the embedded system of the present invention is: the data received from each communication interface is processed by the embedded system and sent to the MAC and baseband processing circuit 13 through the PCMCIA interface, and processed by the MAC in the module The circuit converts the data into a timing waveform that matches the baseband processing circuit, and then the baseband processing circuit adds the physical layer header to the data sent by the MAC layer, and performs BPSK/QPSK/CCK modulation on the data, and the generated analog signal is then The I/Q modulation is performed by the intermediate frequency processing circuit 14 to the intermediate frequency, and the RF/IF conversion is performed by the radio frequency processing circuit 15 to the ISM frequency band, and finally transmitted into space through the radio frequency power amplifier circuit 16 and the antenna module 17. The data receiving process is that the signal received from the antenna is firstly filtered, amplified, frequency converted, and intermediate frequency I/Q demodulated, and then sent to the baseband processing circuit in module 13 for BPSK/QPSK/CCK demodulation to remove the physical layer header. The MAC processing circuit intercepts the data packet and forwards it to the embedded processor through the PCMCIA interface; the embedded processor U1 processes or forwards the data to the corresponding wired or wireless interface according to the requirements.

The core embedded processor U1 of the wireless protection access device based on the embedded system of the present invention adopts the processor chip of the POWERPC series of Motorola Company with a clock frequency of 100M. On the one hand, it is connected with two 16Bit×8M×2Bank, a total of 32Mbyte SDRAM dynamic random access device chip (HY57V651620B TC-10S) and two 16Bit×1M×2Bank, a total of 4Mbyte FLASH flash memory chip (AMD29LV160DB) to form a memory module circuit 5. The connection between them is accomplished by data address lines 33, 34, which include the connection of data signal lines, address signal lines and other auxiliary control lines. The power supply module 6 meets various power supply requirements for the MPC852T processor U1 and its peripheral circuits. The reset and hardware initialization module 7 completes the software and hardware reset process of the MPC852T processor U1. The sequential circuit module 8 provides different clock sequences required by the system. The MPC852T processor also has a BDM debugging interface circuit 9, which completes the debugging process of the hardware device of the present invention and the debugging and upgrading process of the software program. MPC852T processor U1 also uses its own FEC to expand a 100M fast Ethernet interface 10 and SCC interface to expand a 10M Ethernet interface 11 to realize the process of connecting the wireless protection access device and the wired network of the present invention. The MPC852T processor U1 also expands a serial interface 41 through its own SMC interface and completes the process of expanding a serial interface 41 through the conversion process of the MAX3222 chip 12 to realize the process of local serial port monitoring. MPC852T processor U1 utilizes PCMCIA interface expansion, realizes the wireless communication interface based on 802.11b through the IntersilPRISM2.5 chipset, and completes the wireless access of data.

The control relationship between the software and hardware modules of the embedded system in the present invention is shown in FIG. 3 . The embedded processor U1 directly controls the read-write flash memory and read-write memory through the embedded LINUX operating system; at the same time, by loading various software driver modules in the embedded LINUX operating system, the embedded processor U1 completes various I/O Expand the control of the communication hardware interface module to realize various forms of communication.

The description of each division module will be described in detail below in conjunction with the accompanying drawings.

1. Minimum embedded system hardware platform 1:

The minimum embedded platform module 1 of the wireless protection access device based on the embedded system of the present invention consists of an MPC852T processor U1 and its supporting circuit 4, a memory module circuit 5, a power supply module circuit 6, a reset and hardware initialization module 7, and a clock module 8 and BDM debugging interface circuit 9. Among them: as shown in Figure 4: MPC852T processor and its supporting circuit 4 include MPC852T processor U1 and running instructions. The MPC852T processor U1 adopted in the present invention is the POWERPC chip processor MPC852TVR50 of Motorola Corporation facing low-end communication.

The memory module circuit 5 is further divided into two sub-modules, the readable and writable storage circuit 30 of the SDRAM dynamic random access memory and the flash memory circuit 31 of the FLASH chip. Among them, the readable and writable storage circuit 30 is composed of two HY57V651620B TC-10S SDRAM chips U2 and U3 with 16Bit×1M×4Bank and a total of 16MByte. This is equivalent to the memory in the computer system and is used to run the system and applications. The flash memory circuit 31 is made up of two AMD29LV160DB FLASH chips U4 and U5 of 16Bit×1M and 4MByte. This is equivalent to the hard disk of the computer system, used to store the operating system, related data and application software. The data line D[0:15] of the read-write storage circuit 30 and the flash memory circuit 31 is connected to the data line D[0:15] of the MPC852T processor U1, and the address line A[0:15] of the read-write storage circuit 30 and the flash memory circuit 31 0:31] is connected with address line A[0:31] of MPC852T processor 1. In addition, a control line is connected to the readable and writable storage circuit 30 and the flash memory circuit 31 . In the memory module circuit 30, 31, the 16M RAM unit allocation occupied by the HY57V651620B TC-10S SDRAM dynamic random access memory of two slices of 16Bit*4M occupies the address units from 0X00000000 to 0X00FFFFFF. Among the two FLASH chips, the first one occupies the address range from 0X40000000 to 0X401FFFFF; the second one occupies the address space from 0X40200000 to 0X403FFFFF. Where 0X40000000 is the offset of the logical address mapping to the absolute address.

In the SDRAM dynamic random access memory, the read and write control of SDRAM is realized by the UPMA (User Porgrammable Machine A) in the memory management module of the MPC852T processor U1. The read and write operation of 16MSDRAM is the data transmission of the 32-bit data bus, which requires the combination of two SDRAMs to provide a data width of 32Bits. The two SDRAM chips work together at the same address, providing input and output of high and low 16-bit data respectively, that is, the data line D[0:15] of the MPC852T processor U1 is connected to the data line D[0:15] of the first SDRAM chip, The data line D[16:31] of the MPC852T processor U1 is connected to the data line D[0:15] of the second SDRAM chip. Since two SDRAM chips need to work at the same time, so as to read and write 32-bit data at a time, the two SDRAM chips are required to use the same chip select signal /CS2, the same clock input CLK, and the same address line to connect A8 and A9 (Bank selection) , /GPLAO: /GPLA3 (read-write control, row and column selection), A18, A20: A29 (address line). The difference is: the UDQM and LDQM pins for mask output of the first SDRAM chip are connected to /BAS1/ and BAS0 respectively; while the UDQM and LDQM pins of the second SDRAM chip are connected to /BAS3 and /BAS2 respectively .

In the FLASH chip system part, A[11:30] of the MPC852T processor U1 is respectively connected to A[19:0] of the FLASH chip, and D[0:15] of the MPC852T processor U1 is respectively connected to D[ of the FLASH chip 15:0]. The /BYTE management pin in MPC852T processor U1 is set high to adopt 16-bit transmission mode. Use the /CSO pin as the chip select signal of the first FLASH chip, and the /CS1 pin as the chip select signal of the second FLASH chip. This connection method uses the GPCM (General-PurposeChip-Select Machine) interface of the MPC852T processor to control the operation of the memory. The /GPLA1 pin controls the output enable of the two FLASH chips; the /WR pin controls the read and write enable of the two FLASH chips. In the GPCM interface of the MPC852T system, /CSO is the chip select signal used to connect the memory storing the startup code, so the FLASH chip connected to the /CSO pin must be equipped with a system boot function.

Power module circuit 6: The power supply of MPC852 requires two levels. The internal logic and DPLL blocks are powered by 1.8V (VDDL and VDDSYNC), while the I/O buffers are powered by 3.3V (VDDH). Therefore, in addition to providing a 3.3V voltage source, a DC-DC circuit module that can convert 3.3V to 1.8V should also be added. We use a general-purpose transformer to change 220V/50Hz to 9V DC, and then connect it to the input terminal of the power module of the board for the second step of DC~DC transformation; instead of using one step to change from 220V/50Hz to 3.3V, it is for Get higher quality level output. In order to obtain a high-quality 3.3V DC voltage, we choose the MAX726 power regulator chip to complete the second step of voltage transformation. MAX726 is a 100KHZ switching power supply chip, which has the advantages of (1) small size and light weight (2) high power conversion efficiency. The 3.3V-1.8V transformer uses SEMTECH's EZ1085C chip. EZ1085 is a high-performance voltage conversion chip.

Reset and hardware initialization module circuit 7: The reset signal of the MPC852T processor U1 through the reset and initialization circuit 7 includes power-on reset, hard reset and soft reset. When the system is powered on, the extremely important sampling and setting of the PLL (phase-locked loop) circuit working modes MODCK1 and MODCK2 in the internal clock module of the MPC852T processor U1 is completed in the power-on reset stage. Then start hard reset and soft reset. In the MPC852T processor U1, it is emphasized that after the system is powered on, the valid signal of the /PORESET pin should last at least 3ms to complete the sampling of MODCK1 and MODCK2.

After power-on reset or hard reset, if the BDIS bit in the reset configuration word is low without connecting the BDM debugging interface 12, the MPC852T processor U1 will read the FLASH chip connected to the chip by the /CSO pin The first 8 bytes store the SSP and PC pointer values, and then start to boot the system through the 16-bit wide FLASH boot port. In fact, due to the control of the underlying hardware by the operating system, the operation of the FLASH is transparent to the application program developed by the present invention to some extent. In the system of the present invention, when the operating system initializes the MPC852T processor U1, it must initialize the relevant registers in the GPCM, and then the GPCM can complete the corresponding function, that is, the transparent operation of the FLASH chip. The pin NC of AMD29LV160DB is connected to A10 of MPC852T processor U1, and the pin NC is grounded. This is to prepare for the replacement of 4M FLASH chips on the same board in the future.

Clock module circuit 8: including PLL and crystal oscillation support circuit. Main design features: (1) Two sets of schemes can be used, one is to use an external active oscillator to input an initial clock signal of not less than 10MHz from the EXTCLK pin, and the other is to use a crystal oscillator circuit between EXTAL and XTAL for 10 The -MHz crystal provides the initial clock signal or the crystal oscillator exists simultaneously. (2) After the clock signals input by the two schemes enter the MPC852T processor U1, according to the setting of the SPLL phase-locked loop when the MPC852T processor U1 is initialized and the MF of the multiplication factor for the PLPRCR register, the MPC852T processor U1 is generated. Internal working clock. (3) DPLL start-up configuration: When PORESET is valid, the start-up configuration of DPLL is sampled from the MODCK[1-2] (pins on the circuit board, which can be jumpered). Then the DPLL immediately uses the clock source determined by MODCK, the multiplier factor, the predivider factor and tries to lock. When PORESET is valid, the MODCK[1-2] signal should be maintained; when PORESET is invalid, the value of MODCK[1-2] is internally latched, and the value of MODCK[1-2] can be changed at this time. In the access device of the present invention, the initial value of MODCK[1-2] is designed to be 01, and the value of PLPRCR is 0x2240c000 to enable the CPU to work at 50MHz.

BDM debugging interface circuit 9: The BDM (Background Debug Model) debugging interface is used in the MPC852T processor U1 to realize the initial configuration and system debugging of the MPC852T processor U1, which is used for core board hardware detection, image file download, operation, FLASH programming. The advantage of using the BDM debugging interface is that the interactive debugging function can be realized without using an emulator.

2. I/O expansion communication module 2:

As shown in Figure 5, in the design of the I/O expansion communication module circuit system, the CPM processor of the MPC852T processor U1 can support 10M/100M and 10M Ethernet connections. Set the register GSMR[MODE] in MPC852T processor U1 to 0B1100 to select the Ethernet communication mode, and SCC (Serial Communication Controllers) executes IEEE802.38/Ethernet CSMA/CD media access control and channel interface under the control of CPM Full set of features. The Ethernet controller of the MPC852T processor U1 requires an external transceiver to be connected to the Ethernet interface. In the present invention, this Ethernet transceiver function is realized by LXT972 10/100M Ethernet physical layer chip U8 and LXT905 10M Ethernet physical layer chip U9. LXT905 chip U9 is an application chip of IEEE 802.3 physical layer, which provides interface circuits for most standard 802.3 controllers to 10BASE-T media. The Ethernet controller in the MPC852T processor U1 ignores the on-chip DPLL and uses the external LXT905 chip U9 to provide corresponding functions. The on-chip DPLL cannot be used for low-speed (1-Mbps) Ethernet because it cannot detect the end of frame correctly.

LXT905 chip U9 uses an isolated transformer HR601624, that is, chip U12 to complete the level conversion interface and drive the 10BASE-T twisted pair cable. The interface adopts the mainstream RJ-45 interface. Logically speaking, 10M Ethernet provides wired access through the SCC1 port of MPC852T processor U1. Seen from the physical connection, the 10M Ethernet interface is composed of some pins of the general interface PA in the MPC852T processor U1 and some pins of the general interface PC. The 10M/100M transceiver interface chip uses INTEL's LXT972 10M/100M Ethernet physical layer chip U8, which directly supports the application of 100BASE-TX and 10BASE-T, and provides Media Inteface medium independent interface (MII) For convenient connection with 10M/100M MAC. It supports 10M/100M dual-two operation, and the operating environment may be set to auto-negotiation (automatic negotiation), parallel detection or manual control.

For the 100M fast Ethernet port, the present invention uses a HR601680 chip U11 to complete the function of the level conversion interface. In the implementation of Ethernet10/100M Ethernet, 25MHz external clock input is used, 4 serial data input lines RXD[0:3], and 4 serial data output lines TXD[0;3] are used for data transmission. The implementation of 10/100M Ethernet occupies the PD[3:15] pins and [1:4] pins of MPC852T processor U1. The PD[3:15] pins are respectively connected to the RXD[0:3] and TXD[0:3] of the LXT972 chip U12, and the SPARE[1:4] pins are connected to the TX_ER, RX_ER, COL and TX_EN are connected correspondingly.

In addition in the present invention, by the serial management control SMC1 module (Serial Management Controllers) serial communication port in the CPM port of MPC852T processor U1, realized the design of the RS-232 serial port circuit 12 of a two lines. The invention adopts the AMD3322 chip U10 to convert the signal output by the MPC852T processor U1 into a serial port signal conforming to the RS-232 serial port level standard, and can transmit data at a rate of 460KBps.

As shown in Figure 6, the MPC852T processor U1 is connected to the wireless access interface module through a standard PCMCIA socket. Each functional module in wireless communication is implemented by each chip in the Intersil PRISM2.5 chipset and the corresponding peripheral circuits:

a) MAC and baseband processing circuit 13 are realized by ISL3873B chip U13: mainly complete baseband modulation and demodulation of data flow; ISL3873B chip includes MAC unit, transmitting and receiving unit and includes an automatic gain control AGC unit, and the transmitting part completes baseband data processing Spread spectrum, coding, and scrambling work, and automatically generate headers and preambles for the transmitted packets; the receiving unit completes the despreading, descrambling, and header removal of the data after IF demodulation. The ISL3873B chip U13 also has a standard PCMCIA interface connected to the PCMCIA socket of the MPC852T U1 for data, address and control information exchange.

b) The HFA3783 chip U14 is an intermediate frequency processing circuit module 14, which is composed of an I/Q modulator/demodulator and a mixer, and completes carrier modulation and demodulation of signals.

c) The ISL3685 chip U15 is the radio frequency processing circuit module 15: it is composed of a 2.4GHz radio frequency/intermediate frequency IF/RF converter and a mixer to realize the frequency conversion of the modulated signal;

d) The ISL3984 chip U16 is the radio frequency power amplifier circuit module 16: mainly amplifies the transmitted radio frequency wireless signal;

e) Antenna module 17: composed of distributed circular pole dual antennas, which completes the conversion of electrical signals and electromagnetic wave signals.

In addition, TXI, TXQ, RXI, and RXQ in the ISL3873B chip U13 are connected to the corresponding TXI, TXQ, RXI, and RXQ pins in the HFA3783 chip U14 to complete the orthogonal transmission process of data. RX_IF_DET is connected to RX_IF_DET in HFA3783 chip U14; RX_IF_AGC is connected to RX_IF_AGC in HFA3783 chip U14, and RX_RF_AGC is connected to H/L in ISL3685 chip U15 to complete the corresponding IF and RF AGC adjustment process. The antenna selection signal ANT_SEL drawn from the ISL3873B chip U13 is connected to the antenna module 17 to complete the selection of the distributed antenna system. The HFA3783 chip U14 and the ISL3685 chip U15 are connected through common coupling. Chips U13, U14 and U15 all use the same 44MHz clock as a clock source.

As shown in Figure 6, the ISL3984 chip U16 is used as a 2.4GHz power amplifier and detector, with a two-stage power amplifier, a power gain of 30dB, and a maximum output power of 18dBm. During the control process, the ISL3873B chip U13 dynamically monitors the output power of the ISL3984 chip by using the obtained output of DET_OUT in the RF power amplifier circuit of the ISL3984 chip U16. When the automatic gain control voltage of the IF modem of the HFA3783 chip U14 needs to be adjusted, the output voltage will change. This provides the most error-free data transfer rate possible under certain operating conditions and compensates for channel-to-channel and temperature-related voltage variations in the transmission chain.

The ISL3685 chip U15 is an RF/IF converter and mixer working at 2.4GHz. It is also a programmable frequency synthesizer and a gain-selectable low-noise amplifier. The interface between the U15 chip and the IF realizes the IF transmission and Receive multiplexing, sharing a differential matching network, transmit and receive RF amplifiers can be directly connected to the mixer, while reducing the use of IF filters. The ISL3685 chip U15 has a gain-selectable (H/L) low-noise amplifier (LNA) and a down-converting mixer (Mixer) in the receiving link channel to achieve signal amplification and down-converting processing; while in the sending link On the channel, an up-conversion mixer (Mixer) and a high-performance signal preamplifier (Preamplifier) complete the up-conversion process of the intermediate frequency signal.

HFA3783 chip U14 is a chip that realizes I/Q quadrature signal modulation and demodulation and frequency mixing. It realizes quadrature modulation and demodulation of I/Q quadrature baseband signals, and integrates AGC for Tx/Rx transmission and reception control module. In the sending link channel, it mainly includes: differential I/Q two-way signal input stage, the signal requires an analog pre-shaped signal of 500mVpp; I/Q road-to-mixer to realize signal modulation; analog signal adder; sending The intermediate frequency signal amplifier; the mixer is driven by a broadband quadrature local oscillator generator, and the intermediate frequency frequency setting and PLL synchronization parameters are controlled by a three-wire serial port. In the receiving link channel, it mainly includes: two-stage low-distortion AGC intermediate frequency amplifier, which can provide an AGC range of 70dB; an intermediate frequency level peak detector; a pair of quadrature double-balanced down mixers, to realize the solution of IF-baseband tune; receiver DC offset correction loop.

Like the ISL3685 chip U15, the IF interface of the HFA3783 chip U14 shares a differential matching network for sending and receiving IF channels, which reduces the number of filter components required in a single IF half-duplex transmitter. The ISL3685 chip U15 interface only uses one audio channel. surface filter to make the connection. Each of HFA3783 chip U14 and ISL3685 chip U15 integrates a programmable frequency synthesizer, which can form a frequency phase-locked loop (PLL) by combining with an external VCO. The signal of the local oscillator (VCO) after the frequency division of the frequency divider with the preset frequency division coefficient is compared with the signal after the frequency division of the reference oscillation frequency by R, and the comparison result is converted into a control signal for controlling the VCO oscillation , this control signal is connected to the voltage control terminal of the VCO through the loop filter to form a frequency phase-locked loop (PLL). In this way, the output frequency of the phase-locked loop can be changed by changing the frequency division coefficient of the preset frequency divider.

The ISL3873B chip U13 is a chip with a rake receiver MAC and baseband processing circuit. The MAC and baseband processing circuit 13 in the access device of the present invention is composed of a special integrated chip ISL3873B of Intersil Corporation and corresponding peripheral circuits. The MAC processing circuit of the ISL3873B chip U13 conforms to the 802.11 wireless LAN MAC protocol, supports BSS and IBSS modes under DCF, optional PCF, RTS/CTS mechanism, response mechanism, and WEP encryption. The baseband processing part of the ISL3873B chip U13 supports DSSS baseband processing functions, including baseband duplex/half-duplex, packet/continuous, all functions of transceivers, and includes A/D, D/A converters, and the working frequency is 1 , 2, 5.5 and 11M, can adopt DBPSK, DQPSK and CCK modulation. The transmitter section includes a network processor interface, preamble and header generators, DPSK modulator, high-speed modulator, data scrambler, transmit filter and spectrum spreader. Complete baseband data spreading, coding, scrambling, etc., and automatically generate headers and preambles for sent packets. When sending, the preamble is always modulated in DBPSK mode, the header can select DBPSK or DQPSK mode and the data packet can select DBPSK, DQPSK or CCK mode. The transmitter automatically switches between DBPSK, DQPSK or CCK modes when required. The purpose of this is to shorten the capture time during synchronization, and once the synchronization is complete, the data can be transferred at a faster rate. The receiving unit includes a CCK correlator, a feedback equalizer, a symbol decision device, a peak detector, a DPSK demodulator, a data descrambler, a numerically controlled oscillator, a loop filter, and a preamble detector. Complete the despreading, descrambling, and header removal of the data after IF demodulation. In addition to the sending unit and receiving unit, the ISL3873B chip also has an automatic gain control (AGC) unit, which together with the AGC unit of the intermediate frequency modulation module and the radio frequency module forms an automatic gain control AGC system, which automatically controls the intermediate frequency and radio frequency according to changes in the environment. Part of the gain and attenuation changes to improve the dynamic range of the receiver.

The PCMCIA socket and the MAC on the embedded system platform are connected with the PCMCIA plug on the baseband processing module to realize the connection between the embedded processor U1 and the wireless access interface.

3. Software system module 3:

As shown in Figure 7, the system hardware of the wireless protection access device based on the embedded system of the present invention is the bearer platform for the realization of the access point function, and the final implementation form of the software is stored in the present invention in the form of firmware (firmware). The FLASH flash memory circuit 31 of the embedded access point device is combined with the MPC852T processor U1 and the hardware system, and it starts running when the power is turned on to complete fast and stable system operation functions. The present invention has chosen to use the MAC layer hardware module platform of the POWERPC MPC852T processor based on Motorola and the POWERPC-LINUX2.4.4 version embedded LINUX operating system to form the hardware and software platform for realization, and then complete the MAC layer protocol on the basis of this platform The construction of stack software module system.

The 802.11b MAC layer software module of the present invention is divided into two parts, the kernel state and the user state, and its main mechanism is to transmit and receive data such as 802.11b data receiving and processing, DCF/PCF media access control module, etc. that have strong real-time requirements, in a kernel-driven manner Functions that do not require high real-time requirements such as authentication management, key negotiation, and 802.1X protocols are implemented in the user state space.

As can be seen in Figure 7, the kernel part of the MAC layer protocol stack software module is composed of 54-65 modules: 54-61 of the MAC layer protocol stack module mainly completes the related functions of MAC layer protocol data sending and receiving and access control defined by IEEE802.11 , complete the coordination function of wireless media channel access, and also complete the bridging function with the interface of Ethernet; module 62 realizes the standard wireless interface providing user state program; module 63 realizes the update function of STA key, and module 23- 25 realize WEP encryption, TKIP encryption and AES encryption of MAC layer data respectively. These three modules are invoked by the module 61 and dynamically loaded through the configuration of the user; the module 65 implements the management function of the connection site.

The user state part of the MAC layer protocol stack software module is composed of modules 66-74: module 66 implements the extraction and filtering of the kernel state data flow, and is the interface between the kernel state module and the user state module. Module 67 realizes the wireless access point management function in IEEE802.11 standard, and adds some improvements of IEEE 802.11b. In module 67, it mainly includes MIB module, Mlme_Requests module, Mlme_Indications module and Distribute_Mmpdus, Power_Save_Monitor, AuthReq_Service_AP, AsocService_AP, AuthRspService and Synchronization_AP and other modules. Module 67 mainly completes the supervision function of the LLC layer and the DS distributed system and the internal data transmission process of the Tx_Rx part. Module 68 and module 69 are sub-modules of module 67, which respectively process management frames of IEEE802.11/11b and EAPOL frames used by IEEE802.11i/WPA/WPA2 protocols. The module 70 realizes the 802.1X protocol, and the module 73 and the module 74 respectively realize the state machine of 802.1X and the state machine of 802.11i/WPA/WPA2 key agreement authentication.

The MAC layer protocol stack module must also complete the corresponding interface with the outside if it wants to realize the operable MAC layer function. There is an interface process between the MAC core and the DS distributed system (that is, the Ethernet driver module 19 ), the wireless network interface part and the upper LLC layer. Both the DS distributed interface and the wireless interface have corresponding device drivers to complete the corresponding interface to complete the interaction with the MAC layer. The MAC layer completes the corresponding MAC layer service interface for the LLC layer to call and completes the interaction process with the LLC layer. The MAC layer software module is based on the actual embedded system platform, so the kernel of the embedded LINUX system software platform 18 must also be provided to complete the action calling function of the MAC layer.

The interaction between the LLC or application layer process and the MAC layer kernel process includes a Data channel and a Control channel, and this interaction process can be completed through memory calls and interrupts. Similarly, the interface with the DS distributed system interface and the wireless network interface can also be completed through memory calling and interrupt methods.

In the specific implementation process, considering the realizability of the system and the efficiency of the system, the present invention does not use the traditional multi-threading method to realize the parallel processing and mutual communication of different modules, but redesigns a parallel processing Way. This is mainly due to the fact that more threads will affect the time and space of the system to switch between threads, which will also affect the efficiency of the system. As mentioned above, the MAC layer protocol stack module includes 22 sub-modules in total.

The PHY I/O driver module completes the driving process of the data transmission process and control process of the I/O interface module. The bridged module in the MAC layer protocol stack software module receives the data frame from the Ethernet driver module 19, and needs to pass it out from the interface of the wireless network. The process of sending data; similarly, the data transmission process in the opposite direction also requires the participation of the PHY I/O driver module.

Also, some of the hardware modules, such as power control, outage detection, AGC process, etc., must be able to be controlled from the MAC layer software module. Therefore, it is required to provide such an interface process in the I/O driver module. In the embedded LINUX system software platform 18, there are three types of driver implementations: character device driver, block device driver and network device driver. At the same time, the driver under the embedded LINUX system software platform can be linked into the kernel in two ways: one way is to dynamically load as a module; the other way is to statically link into the kernel. Because dynamic loading has greater flexibility than static linking, so the realization of each driver among the present invention all adopts the mode of dynamic module loading to write, on the software to ISL3873B chip U13 control port, HFA3783 chip U14 and ISL3685 chip U15 The driver control of the control port is completed as a character device driver; while the transmission operation driver for the U13 data port of the ISL3873B chip is completed as a network device driver.

The working process of the control port of the wired I/O driver module is as follows: In the software process, first generate a file_operation structure for the module, which contains all the called functions: read, write, ioctl, release functions, etc. In the working process of the SPI interface of the MPC852T processor U1, the pins of the SPI interface need to be configured in the init_module() function; the working mode of SDMA is set; Register the interrupt handler; apply for a memory block that can use DMA; register this character device with the kernel; the open() function module completes the counter accumulation. The Write() function finishes copying the data from the user space to the kernel space, and sends the data; at the same time, it checks whether the sending is successful, and reports an error message to the upper layer if there is an error. The Read() function copies the address to be written to the kernel space, sends the address, starts receiving after sending, checks whether there is an error, and reports an error message to the upper layer if there is an error. The Close() function module decrements the counter by one. The Cleanup_module() function module releases the allocated memory and revokes the character device. During the working process of the data port, SCC can implement many common protocols, such as ETHERNET, HDLC, BITSYNC, TRANSPARENT, APPLETALK, etc. The present invention selects the TANSPARENT mode without additional CRC check to complete the sending and receiving process of the data port.

The remote SNMP/HTTP/CLI remote network management module 28 provides SNMP/HTTP/CLI ports for the access point so that the remote monitoring terminal can control and monitor the working parameters and performance of the access point device through the network. The SNMP/HTTP/CLI remote network management module 28 is a program that resides in the AP to communicate with the remote terminal. By monitoring ports 161 and 162, SNMP/HTTP/CLI communication with remote terminals can be realized, and the operating parameters of the MAC layer protocol can be modified, and the corresponding IEEE 802.11 MIB library can be established to achieve unified and compatible network management. The local serial port module 29 for local serial port monitoring completes the reception and transmission of serial port information, and can change the operating parameters of the MAC protocol stack in real time to realize the function of local monitoring. The programming of the serial port driver module 20 realizes the driving of the serial port. The preparation of the Ethernet driver module 19 realizes the driver of the 10M/100M Ethernet under the embedded LINUX system software platform 18, and simultaneously completes the behavior of filtering the corresponding frames. Finally, the simplification of the 18 cores of the embedded LINUX system software platform must be completed to meet the requirements of the small access space of the embedded system.

As shown in Fig. 8, the flow process of the MAC layer software protocol stack module program of the present invention is as follows: after the equipment is powered on, the loading of the initialization program completes the initialization process of the MPC852T processor U1, and completes the assignment of the internal registers of the MPC852T processor U1 The initialization process of positioning and working mode, and the initialization of other peripheral chips have also been completed. In the MPC852T processor, the following steps are carried out in sequence: loading and running of the embedded LINUX system, loading, mounting and running of each driver program, running of the MAC layer protocol stack program, SNMP/HTTP/CLI remote network management The operation of the program, the main() function in the MAC layer protocol stack module runs, starts the operation of 9 threads in the MAC layer protocol stack program, and then enters the thread cycle process, when data is received in the cycle process, and then Judgment is made, when the data is received from the wired network and is to be transmitted to the wireless network, the corresponding process of sending from the wireless network is started to complete the process of sending out from the wireless network. When the data received from the wireless access terminal is to be sent to the wired network, another process sent from the wired network is started to complete the corresponding process. In addition, when the control data of SNMP/HTTP/CLI mode is received, it is started The corresponding SNMP/HTTP/CLI remote network management operation process completes the adjustment process of the operating parameters of the MAC layer protocol stack module. When abnormal processing occurs during the above-mentioned thread processing and process processing, the program will exit, otherwise the MAC layer protocol stack software module will continue to run in a loop.

It should be understood that those skilled in the art can make various possible changes or substitutions according to the preferred embodiments of the present invention and its technical concept, and all these changes or substitutions should belong to the appended rights of the present invention. the scope of protection required.

Claims (9)

1. A wireless access protection device based on an embedded system, characterized in that the device includes the following three modules: a minimum embedded system platform module (1), an I/O expansion communication module (2) and a software system module (3); wherein, the minimum embedded system platform module (1) includes: an embedded processor U1 and its support circuit (4), memory module circuit (5), power supply module circuit (6), reset and hardware initialization module circuit (7), clock module circuit (8) and BDM debugging interface module circuit (9); the I/O expansion communication module (2) includes two parts, a wired communication interface and a wireless access interface, and the wired communication interface includes 10/100M fast Ethernet interface circuit (10), 10M Ethernet interface circuit (11) and serial interface circuit (12), the wireless access interface consists of MAC and baseband processing circuit (13), intermediate frequency processing circuit module (14), radio frequency processing circuit Module (15), radio frequency power amplifier circuit module (16) and antenna module (17) form; Software system module (3) comprises embedded LINUX operating system software platform (18) and MAC layer protocol stack software module, MAC layer protocol stack software The module includes the following parts: Ethernet driver module (19), serial port driver module (20), PCMCIA driver module (21), wireless access hardware driver module (22), WEP encryption module (23), TKIP encryption module (24), AES encryption module (25), bridge device driver module (26), 802.1X authentication module (27), remote network management module (28) in SNMP/HTTP/CLI mode, and a serial port module that completes local configuration functions (29); Embedded processor U1 is electrically connected with a readable and writable memory circuit (30) and a flash memory circuit (31) respectively by data, address, control line (33,34), and embedded processor U1 also passes through Another data line (35) is electrically connected with a storage auxiliary circuit (32); the embedded processor U1 is also electrically connected with a power supply module circuit (6), a reset and hardware initialization module circuit (7), a clock module circuit (8) ), the BDM debugging interface module circuit (9), jointly constitute a minimum embedded system platform module (1); the embedded processor U1 is also connected with a 10/100M Fast Ethernet interface by control lines (36, 37, 38) circuit (10), 10M Ethernet interface circuit (11) and serial interface circuit (12), and these interface circuits are respectively connected to Ethernet interface (39, 40) and serial interface circuit (39, 40) and serial Interface (41); Embedded processor U1 connects wireless access module circuit (45) by standard PCMCIA interface socket (46), constitutes an I/O expansion communication module with multiple communication forms; Embedded processor U1 and each The communication sub-modules complete the communication connection and communication cooperation process through the corresponding driver module and the MAC layer protocol stack software module. 2. The wireless access protection device based on an embedded system according to claim 1, characterized in that: the MAC and baseband processing circuits in the wireless access interface combine MAC layer data processing and baseband modulation and demodulation adjustment together , improve the processing efficiency; the intermediate frequency processing circuit module completes the carrier modulation and demodulation of the signal; the radio frequency processing circuit module completes the frequency conversion of the modulated signal; the radio frequency power amplifier circuit module completes the amplification processing of the transmitted radio frequency wireless signal ; while the antenna module completes the conversion of electrical signals and electromagnetic wave signals. 3. The wireless access protection device based on embedded system according to claim 1 or 2, characterized in that: said wireless access interface part and said minimum embedded system platform module (1) adopt The standard "PCMCIA" interface completes the signal connection and timing matching process, which provides more options for the design of the smallest embedded system platform module (1). 4. The wireless access protection device based on an embedded system according to claim 1 or 2, wherein the embedded processor is an "MPC852T" module. 5. The wireless access protection device based on an embedded system according to claim 1, characterized in that: in the wireless access module circuit, the relevant modules of the "PRISM2.5" chipset of the "Intersil" company are used And peripheral circuit completes each function module; And described MAC and baseband processing circuit are realized by the baseband processing circuit chip " ISL3873B " of band MAC layer data processing and rake receiver and peripheral circuit; Described intermediate frequency processing circuit module is then by I /Q modulation/demodulator and mixer chip "HFA3783" and peripheral circuits; the RF/IF conversion process of the RF processing circuit module is completed by 2.4GHz RF/IF converter and mixer chip ISL3685 and peripheral circuits ; The radio frequency power amplifier circuit module is composed of a 2.4GHz power amplifier and a detector ISL3984; the antenna module is composed of distributed circularly polarized dual antennas. 6. The wireless access protection device based on an embedded system according to claim 1, characterized in that: the MAC layer protocol stack software module completes the MAC layer protocol stack defined by IEEE802.11, 802.11i, WPA/WPA2 Basic functions and security expansion functions, complete the coordination function of wireless media channel access, wireless protection access WPA security function and complete the bridging function with the Ethernet interface. 7. The wireless access protection device based on an embedded system according to claim 1 or 6, characterized in that: the MAC layer protocol stack software module is divided into two parts, the kernel state and the user state. The 802.11b data transceiver processing and DCF/PCF media access control modules are implemented in a kernel-driven manner, and the functions that do not require high real-time performance of the authentication management, key negotiation, and 802.1X protocol are implemented in the user space. 8. The wireless access protection device based on an embedded system according to claim 7, characterized in that: the user state part of the MAC layer protocol stack software module adopts a single thread mode, and the 16 functional submodules of the user state part Use custom message queue interaction to communicate, reducing system overhead. 9. The wireless access protection device based on an embedded system according to claim 7, wherein the WEP encryption module, the TKIP encryption module and the AES encryption module are driven by the kernel in the kernel state part in the MAC layer protocol stack software module It is implemented in the form of modules and called through dynamic calls, reducing system overhead and ensuring real-time data transmission requirements.

Images