In the semiconductor industry, data is the lifeblood.From design to tape-out, a single chip involves massive core intellectual property (IP), design drawings, process parameters and test data. Any data breach or network outage may result in incalculable losses. As a high-tech enterprise specialised in the R&D, production and sales of memory module products, XinCun Technology imposes extremely stringent requirements on the security, stability and confidentiality of its internal network.Faced with rigorous data security standards for chip R&D scenarios, AINOPOL has built a high-speed, secure and reliable all-optical network for XinCun Technology to comprehensively safeguard its core data assets for chip development.

I. High Stakes Amid Multiple Challenges

Network requirements for chip design enterprises far exceed those of ordinary office networks. The network carries not emails and web pages, but GDSII layout files often dozens of gigabytes in size, IP cores requiring persistent online protection, and internet activities subject to compliance audits at any time. While reviewing its existing network infrastructure, XinCun Technology identified a host of challenges:

R&D Data Security: Core Assets Must Be Fully Protected

The leakage of design drawings, IP cores or simulation data often leads to immeasurable losses. Conventional enterprise networks frequently rely on passive security measures: outdated firewall rules, default passwords on core devices, and unencrypted transmission of R&D data across network segments. For chip firms, this is equivalent to storing core assets in an unlocked room.

Lateral Movement Risks: Compromise at One Point Spreads Across the Entire LAN

Office networks face daily threats including phishing emails, web malware and USB-borne viruses. Once an office endpoint is compromised, attackers can move laterally within the same network — jumping between PCs and infiltrating R&D and production zones from the office network. If the chip R&D network suffers lateral penetration, core design data and process parameters face dual threats of theft and ransomware encryption.

Internet Experience: Unregulated Traffic, Roaming Dropouts and Inadequate Concurrent Support

Wireless coverage gaps persist in office areas, meeting rooms and laboratories, causing frequent disconnections as staff move between zones. EDA simulation and layout files are often dozens of gigabytes large; engineers concurrently pull, submit and compare files during overlapping time windows. Network congestion not only slows downloads but disrupts R&D workflows — waiting for a single file transfer can waste half a working day.

Compliance Auditing: Dual Mandates of Classified Protection 2.0 and Public Security Order No.151

Chip enterprises are generally subject to Classified Protection of Cybersecurity 2.0 and must implement real-name internet access and log retention requirements under Public Security Order No.151. Untraceable online behaviour and non-compliant log retention expose businesses to official notices and rectification orders from cybersecurity authorities, turning the network from a productivity tool into a compliance liability.

Network O&M: Limited Dedicated Staff, Zero Room for Error

R&D teams focus on core business, resulting in limited in-house IT manpower. Yet chip industry networks cannot tolerate outages: a single disconnection may delay the entire R&D pipeline. Rapid fault localisation and minimal downtime directly determine whether O&M can remain lightweight and stable.

II. Integrated Chip-Level Protection: Four Lines of Defence

1. Four-Tier Security Architecture to Safeguard R&D Data

Tailored to chip enterprises’ high priority on R&D data protection, the solution establishes four defensive lines spanning the network boundary down to the physical layer:

• Precise Ingress Filtering & Interception: Intelligent Risk Control Against Phishing Attacks
  The ZH-M1 next-generation firewall is deployed at the network egress, integrating three engines: IPS intrusion prevention, AV antivirus and WAF web application protection. It incorporates over 10,000 defence rules and a 4+ million signature virus library to block exploit attempts, web infiltration and malicious traffic in real time. Meanwhile, a cross-network domain and URL intelligent risk control system dynamically resolves and blocks malicious emails, phishing links and infected attachments. It accurately identifies phishing content disguised as maintenance notifications, chip documentation or supply-chain files and works in tandem with the firewall to block threats at the entry point. Combined protection covers traditional attack signatures as well as emerging threats such as social engineering fraud and supply-chain poisoning, delivering end-to-end active defence from the network perimeter to business activities.
• Access Security: Device Admission Control to Block Unauthorised Access
  Supporting 802.1X, Portal, WeChat/DingTalk/Lark authentication and MAC whitelisting. The system enforces endpoint compliance checks and instantly blocks and isolates unauthorised devices to secure LAN access points.
• Network-Layer Security: Dual Isolation via WAF + VLAN to Halt Lateral Penetration
  A web application firewall filters malicious traffic, while VLANs provide rigid network segmentation. The corporate network is partitioned into confidential R&D zones, controlled production zones, office internet zones and third-party supplier access zones. Only whitelisted ports and minimum necessary access permissions for business workflows are enabled.
• Physical-Layer Security: Inherent Anti-Interference Fibre Eliminates Electromagnetic Eavesdropping Risks
  Built on an all-optical architecture, fibre is naturally immune to electromagnetic interference and emits no electromagnetic radiation. It mitigates side-channel risks from electromagnetic leakage at the physical layer — a critical confidentiality requirement for chip manufacturers.

2. Core Routing + Optical APs to Support High-Concurrency Transmission

The ZH-AC300R egress router manages external bandwidth and overall LAN bearer. Traffic scheduling and bandwidth prioritisation guarantee precedence for critical services while deprioritising non-essential traffic. ZH-AP30006S-M optical APs are deployed across offices, meeting rooms and common areas. Powerful concurrent processing and seamless roaming enable automatic, invisible handovers as staff move with terminals, eliminating frequent disconnections during video conferences and large file transfers.

3. ZH-M1 Internet Behaviour Management for Auditable Compliance

The built-in AC internet behaviour management and full audit capability of the ZH-M1 firewall meet requirements of Classified Protection 2.0 and Public Security Order No.151. Internet logs are stored locally for no less than six months, enabling traceability and control of all employee online activity. This transforms XinCun’s network from a compliance risk into a verifiable compliant system.

4. EaaS Cloud Management for Full O&M Visibility

All network devices (routers, firewalls, switches, APs) are centrally managed on the EaaS cloud platform, delivering traffic visualisation, automated policy distribution and fault alerts. Common faults can be located and resolved remotely, reducing reliance on dedicated network administrators and shifting O&M from reactive fire-fighting to visualised, predictive management with fewer business disruptions.

The improvements are tangible. GDSII layouts and simulation data in the R&D zone flow at high speed across the LAN; dense wireless coverage avoids congestion, and mobile teams no longer hunt for stable signals. Security logs are retained on schedule with fully auditable activity, so IT leads avoid scrambling for evidence during compliance inspections. Issues that once required toggling between multiple management interfaces can now be traced end-to-end within a single architecture view.

The deeper impact is peace of mind. For chip enterprises, data security is not an expense — it is the lifeblood. When security is embedded natively into the network and all four core pressures are addressed by one unified architecture, R&D teams can focus on circuits and algorithms rather than worrying about data leakage. This implementation exemplifies AINOPOL’s “integrated connectivity and encryption” philosophy for the semiconductor sector: a stable network enables confident innovation.

Chip manufacturers are protected not by a single piece of hardware, but by a network built with security as its foundation. The deployment at XinCun demonstrates how one-stop optoelectronic converged communications turn the mantra “data security is our lifeblood” into tangible assurance with every bit transmitted across the network.