Active network defense system for embedded equipment and defense method thereof

Abstract

An active network defense system for embedded equipment includes a network protocol stack module and an active network defense module. The active network defense module comprises a firewall upper-layer module and a firewall bottom-layer module. The firewall upper-layer module includes a message detection module and an exception handling module. A system defense method includes: 1, installing an active network defense system; 2, enabling the message detection module to analyzes a received network message to determine whether the message has a problem, directly transmitting the message to a protocol stack if not, or going to the next step if so; 3, enabling an exception handling unit to determine whether an exception message is an attack message, going to the next step if so, or sending a request message to query the real environment of the network and returning to step 2 if not; 4, discarding the current message, setting a white / black list, and opening a bottom-layer filter. The active network defense system for embedded equipment has characteristics of active identification and defense, and can prevent common embedded network attacks suffered by embedded equipment, thereby protecting the network security of the embedded equipment.

Description

technical field [0001] The invention belongs to the field of embedded, in particular to an active network defense system for embedded and a defense method thereof. Background technique [0002] With the rapid development of embedded devices, more and more embedded devices are being connected to the network in their applications, such as automotive electronic equipment, medical equipment and power equipment. When these devices are able to access the network, if sufficient security issues are not considered, they will be vulnerable to cyber attacks. Without some appropriate security measures, these attacks may compromise the functionality of the device, the system, and the information inside the device. [0003] Today, there are many network firewalls on the market, but most of these firewalls are used in the field of servers, enterprises and personal PCs. There are relatively few network firewalls for embedded devices. [0004] The existing embedded network firewalls curre...

AI Technical Summary

Problems solved by technology

[0012] The exception handling module is used to handle exceptions after packet detection finds problems. The exception handling methods are divided into two types: the first one is for network packets that can clearly determine problems, such as SYN floods, network storms, Distributed denial-of-service attacks, etc., the exception handling module notifies the firewall filter of the driver layer, and starts to perform corresponding filtering operations on the network packets received by the embedded device; ARP spoofing, replay attacks, etc., the exception handling module actively sends request messages, asks the device communicating with it, and determines whether there is a problem

Images