Safety rule configuration method of firewall without IP

Abstract

The present invention discloses a safety rule configuration method of a firewall without an IP. A firewall without an IP is deposited at the front end of a protected device, a firewall management system does not direct send data to the firewall without an IP when sending a detection data packet and configuring the data packet, and sends data to the protected device, and the data is captured by the firewall to perform identification and processing to complete the safety rule configuration. In order to perform accurate identification of the data packet, the safety rule configuration method of the firewall without an IP takes a special port as a first feature, takes a customized protocol header as a second feature and performs corresponding process aiming at the type of the identified data packet.

Description

technical field [0001] The invention belongs to the technical field of industrial control system information security, and more specifically relates to a method for configuring security rules without an IP firewall. Background technique [0002] With the continuous integration of industrialization and informatization, information, network, and Internet technologies are gradually applied to the field of industrial control, and the industrial control system is gradually breaking the previous closedness. The current industrial network is mainly protected by traditional firewalls. Such firewalls usually have IP addresses for accurate detection and rule configuration. However, firewalls with IP addresses can be detected by scanning tools in the LAN, and the firewall itself may be used as a Attack objects, and then attack the entire control network; and a firewall with IP will change the topology of the entire control network in the access network, and has defects in installation ...

AI Technical Summary

Problems solved by technology

The current industrial network is mainly protected by traditional firewalls. Such firewalls usually have IP addresses for accurate detection and rule configuration. However, firewalls with IP addresses can be detected by scanning tools in the local area network. The firewall itself may be used as a Attack objects, and then attack the entire control network; and a firewall with IP will change the topology of the entire control network in the access network, and has defects in installation and management

In order to better protect the effect, it is usually set to the mode without IP. At this time, the management configuration of the firewall is difficult to achieve by relying on traditional technologies.

Images