Industrial control firewall implementing method for supporting filtering IEC 104 protocol

Abstract

The invention discloses an industrial control firewall implementing method for supporting the filtering IEC 104 protocol. According to the method, an IEC104 module is arranged in a firewall kernel to conduct filtering processing on a data package, filtering and validity check of the industrial control IEC 104 are achieved, validity, effectiveness and integrity of an industrial order are guaranteed, and filtering efficiency is improved; besides, the content filtering function originally achieved only by an agent mode is achieved; resource consumption of a CPU by the agent mode is avoided; furthermore, firewall administrators are divided according to different permission, two identity identification modes are adopted when the administrators have access to a system, and system security is enhanced.

Description

technical field [0001] The invention relates to the field of industrial control firewalls, in particular to a method for realizing a high-performance industrial control firewall supporting filtering of the IEC104 protocol. Background technique [0002] With the increasing demand for information security in the field of industrial control, firewalls are becoming increasingly important; in view of the particularity of the field of industrial control, filtering some commonly used industrial control protocols, such as IEC104 protocol, is an essential function of industrial control firewalls. [0003] Due to the large communication capacity of Ethernet and the good openness of TCP / IP protocol, Ethernet has been unanimously considered as the future development direction of intra-station LAN of substation automation system. The IEC104 protocol is a standard for transmitting the application service data unit (ASDU) of IEC101 with the network protocol TCP / IP. This standard provides t...

AI Technical Summary

Problems solved by technology

[0004] However, the traditional packet filtering firewall works at the network layer and the transport layer, and determines whether to allow the data packet to pass through according to factors such as the IP source address, IP destination address, TCP source port number, TCP link status or their combination of the data packet. , this method is not applicable to the IEC104 protocol; and the packet filtering firewall does not target the commonly used industrial control protocols

In addition, the proxy firewall works at the application layer and completely controls the session. For a specific application layer protocol, by establishing a special proxy service program for each application service, although it can monitor and control the communication flow of the application layer, its speed It is slow and consumes too much CPU resources, which affects the promotion and application of proxy firewalls

Images